IEEE 802.1X-2010：局域网和城域网的端口访问控制标准

802.1X-2010

需积分: 44 200 浏览量更新于2024-07-16 收藏 2.05MB PDF 举报

"IEEE 802.1X-2010 局域网和城域网.基于端口的网络通路控制" IEEE 802.1X 是一个由 IEEE（电气与电子工程师协会）制定的标准，主要用于局域网（LAN）和城域网（MAN）的基于端口的网络接入控制。该协议定义了一种机制，允许网络管理员仅允许经过身份验证的设备访问网络资源。802.1X 协议的核心在于它将认证过程与物理连接分离，确保只有经过授权的设备才能接入网络。 802.1X 的工作原理是这样的：当一个设备尝试连接到网络时，它会尝试通过接入点（如交换机端口）通信。此时，接入点处于一种称为“隔离”或“阻塞”状态，不允许任何数据传输。接着，802.1X 客户端（通常是用户设备）向接入点发送一个请求，启动认证过程。接入点作为边缘认证代理（也称作端口接入实体，PAA），转发这个请求给认证服务器，通常是 RADIUS（远程认证拨入用户服务）服务器。认证服务器负责处理认证请求，验证用户的身份和权限。一旦用户设备通过了认证，认证服务器会通知接入点，接入点则会从“隔离”状态切换到“开放”状态，允许设备访问网络。如果认证失败，设备将无法访问网络资源，即使物理上已经连接到端口。这种机制为网络提供了安全层，防止未经授权的设备接入并访问敏感数据。 IEEE 802.1X-2010 是 2004 年版本的修订版，包含了对协议的更新和改进，以适应不断变化的网络安全需求。标准涵盖了多种认证方法，包括但不限于：EAP（可扩展认证协议），它可以支持多种不同的认证方式，如密码、证书、智能卡等。此外，802.1X 还可以与其他安全技术结合，如 IEEE 802.11i（Wi-Fi 安全）和 IEEE 802.1AE（MAC 层安全性，MACsec）来提供端到端的安全保护。 802.1X 不仅仅应用于 LAN 和 MAN，还被广泛应用于无线网络、企业环境、公共热点、VoIP 电话系统以及物联网设备的接入控制。它的应用领域包括但不限于网络安全、数据中心访问控制、移动设备管理以及各类需要安全接入的场景。 IEEE 802.1X-2010 提供了一种强大的网络接入控制机制，通过在端口级别实施认证，确保只有合法用户和设备能够访问网络资源，从而提高了网络的安全性和可控性。

Tables

Table 5-1 System recommendations ..................................................................................................... 18

Table 9-1 MKA Algorithm Agility parameter values........................................................................... 64

Table 9-2 Key Server Priority values.................................................................................................... 67

Table 9-3 MKA Participant timer values .............................................................................................. 75

Table 10-4 Announcement performance parameters .............................................................................. 84

Table 11-1 EAPOL group address assignments...................................................................................... 88

Table 11-2 EAPOL Ethernet Type assignment....................................................................................... 89

Table 11-3 EAPOL Packet Types ........................................................................................................... 90

Table 11-4 EAPOL Packet Type Destination Addressing ...................................................................... 92

Table 11-5 Descriptor Type value assignments ...................................................................................... 95

Table 11-6 MKA parameters—fixed width encoding............................................................................. 97

Table 11-7 MKPDU parameter sets ........................................................................................................ 98

Table 11-8 EAPOL-Announcement TLVs ........................................................................................... 104

Table 11-9 Access Information ............................................................................................................. 106

Table 13-1 Use of ifGeneralInformationGroup objects ........................................................................ 127

Table 13-4 PAE managed object cross-reference table ........................................................................ 128

Table 13-2 Use of ifCounterDiscontinuityGroup Object...................................................................... 128

Table 13-3 Use of ifStackGroup2 Objects ............................................................................................ 128

Table 13-5 PAC managed object cross-reference table ........................................................................ 134

Table C-1 State machine symbols........................................................................................................ 194

Authorized licensed use limited to: xiangxing lin. Downloaded on March 03,2020 at 07:32:38 UTC from IEEE Xplore. Restrictions apply.

IEEE Standard for

Local and metropolitan area networks—

Port-Based Network Access Control

IMPORTANT NOTICE: This standard is not intended to ensure safety, security, health, or

environmental protection in all circumstances. Implementers of the standard are responsible for

determining appropriate safety, security, environmental, and health practices or regulatory requirements.

This IEEE document is made available for use subject to important notices and legal disclaimers. These

notices and disclaimers appear in all publications containing this document and may be found under the

heading “Important Notice” or “Important Notices and Disclaimers Concerning IEEE Documents.”

They can also be obtained on request from IEEE or viewed at http://standards.ieee.org/IPR/

disclaimers.html.

1. Overview

1.1 Scope

For the purpose of providing compatible authentication, authorization, and cryptographic key agreement

mechanisms to support secure communication between devices connected by IEEE 802

Local Area

Networks (LANs), this standard

a) Specifies a general method for provision of port-based network access control.

b) Specifies protocols that establish secure associations for IEEE Std 802.1AE™ MAC Security.

c) Facilitates the use of industry standard authentication and authorization protocols.

1.2 Purpose

IEEE 802

LANs are deployed in networks that convey or provide access to critical data, that support mission

critical applications, or that charge for service. Protocols that configure, manage, and regulate access to

these networks and network-based services and applications typically run over the networks themselves.

Port-based network access control regulates access to the network, guarding against transmission and

reception by unidentified or unauthorized parties, and consequent network disruption, theft of service, or

data loss.

Authorized licensed use limited to: xiangxing lin. Downloaded on March 03,2020 at 07:32:38 UTC from IEEE Xplore. Restrictions apply.

IEEE Std 802.1X-2010 IEEE STANDARD FOR LOCAL AND METROPOLITAN AREA NETWORKS

1.3 Introduction

The stations attached to an IEEE 802 LAN transmit and receive data frames using the service provided by

the IEEE 802 LAN MAC at a service access point, often referred to as a port, within each end station or

bridge. Port-based network access control specifies a common architecture comprising cooperative

functional elements and protocols that

a) Use the service provided by the LAN MAC, at a common service access point, to support a

Controlled Port that provides secure access-controlled communication and an Uncontrolled Port that

supports protocols that initiate the secure communication or do not require protection.

b) Support mutual authentication between a Port Access Entity (PAE) associated with a Controlled

Port, and a peer PAE associated with a peer port in a LAN attached station that desires to

communicate through the Controlled Port.

c) Secure the communication between the Controlled Port and the authenticated peer port, excluding

other devices attached to or eavesdropping on the LAN.

d) Provide the Controlled Port with attributes that specify access controls appropriate to the

authorization accorded to the peer station or its user.

This standard specifies the use of EAP, the Extensible Authentication Protocol (IETF RFC 3748 [B14]

), to

support authentication using a centrally administered Authentication Server and defines EAP encapsulation

over LANs (EAPOL, Clause 11) to convey the necessary exchanges between peer PAEs attached to a LAN.

Where communication over the LAN connecting a Controlled Port to its peer(s) is physically secure, no

additional protocol is required to protect their communication. This mode of operation is supported by this

standard. More commonly intrusion into the LAN communication is a principal security threat, and the

result of mutual authentication is not simply Controlled Port authorization to transmit and receive data, but

secure distribution of master keys and associated data to the communicating peers. Proof of possession of

master keys subsequently serves as proof of mutual authentication in key agreement protocols. These

protocols generate keys that are used to cryptographically protect data frames transmitted and received by

the Controlled Port. IEEE Std 802.11™ Wireless LANs specifies protocols that associate wireless stations

with access points and initiate mutual authentication using the procedures specified in this standard, the

subsequent generation of keys to protect data transfer, and the cryptographic methods that protect data

frames using those keys. IEEE Std 802.1AE MAC Security (MACsec) specifies cryptographic support of

the Controlled Port for other media access methods. Authenticated key agreement for MAC Security, as

specified in this standard, specifies the generation of the Secure Association Keys (SAKs) used by MACsec.

Use of the Controlled Port can be restricted by access controls bound to the results of authentication and

distributed via AAA protocols such as Diameter (IETF RFC 3588 [B13]) or RADIUS (IETF RFC 2865

[B8]). Attributes supporting certain port-based network access control scenarios are described in IETF RFC

3580, IETF RFC 4675, and IETF RFC 4849.

Clause 7 illustrates use of the above components and protocols in typical network access control scenarios.

1.4 Provisions of this standard

The scope (1.1) of this standard is addressed by detailed specification of the following:

a) The principles of port-based network access control operation, identifying the protocol components

that compose a port-based network access control implementation (Clause 6).

The numbers in brackets correspond to those of the bibliography in Annex B.

Authorized licensed use limited to: xiangxing lin. Downloaded on March 03,2020 at 07:32:38 UTC from IEEE Xplore. Restrictions apply.

PORT-BASED NETWORK ACCESS CONTROL IEEE Std 802.1X-2010

b) A PAE component, that supports authentication, authorization, and the key agreement functionality

required by IEEE Std 802.1AE to allow a MAC Security Entity (SecY) to protect communication

through a port (6.3, Clause 12).

c) A Port Access Controller (PAC) component, that controls communication where the attached LAN

is deemed to be physically secure and provides point-to-point connectivity (6.4).

d) The key hierarchy used by the PAE and SecY (6.2).

e) The use of EAP by PAEs to support authentication and authorization using a centrally administered

Authentication or AAA Server (Clause 8).

f) An encapsulation format, EAPOL, that allows EAP Messages and other protocol exchanges to

support authentication and key agreement to be carried directly by a LAN MAC service (Clause 11).

g) A MAC Security Key Agreement protocol (MKA) that the PAE uses to discover associations and

agree the keys used by a SecY (Clause 9).

h) An EAPOL Announcement protocol that allows a PAE to indicate the availability of network

services, helping other PAEs to choose appropriate credentials and parameters for authentication and

network access (Clause 10).

i) Requirements for management of port-based access control, identifying the managed objects and

defining the management operations for PAEs (12.9).

j) SMIv2 MIB objects that can be used with SNMPv3 to manage PAEs (Clause 13).

The use of port-based network access control in a number of applications is described (Clause 7) to illustrate

the use of these components and the requirements taken into account in their specification. To facilitate

migration to this standard, Annex G (informative) uses the same concepts to describe the architectural

modeling of unsecured multi-access LANs, a widely deployed form of authenticated port-based network

access control that does not meet the security requirements of this standard. Administrative connectivity to

unauthenticated devices, as required for use of industry standard ‘Wake-on-LAN’ (WoL) protocols, is

described for the scenarios of Clause 7; Annex F (informative) provides background information on WoL.

This standard defines conformance requirements (Clause 5) for the implementation of the following:

k) Port Access Entities (PAEs)

l) Port Access Controllers (PACs)

Annex A provides PICS (Protocol Implementation Conformance Statement) Proformas for completion by

suppliers of implementations that are claimed to conform to this standard.

The basic architectural concepts, such as ‘port’, that this standard relies on are reviewed in Annex D.

This standard uses and selects options provided by EAP and AAA protocol specifications, but does not

modify those specifications (see Clause 2 for references). Annex E (informative) provides EAP and

RADIUS usage guidelines.

The specification and conformance requirements for association discovery and key agreement for IEEE

802.11 Wireless LANs are outside the scope of this standard (see IEEE Std 802.11). That standard makes use

of the PAE specified by this standard.

Authorized licensed use limited to: xiangxing lin. Downloaded on March 03,2020 at 07:32:38 UTC from IEEE Xplore. Restrictions apply.

剩余221页未读，继续阅读

chemical987

粉丝: 1

IEEE 802.1X-2010：局域网和城域网的端口访问控制标准

802.1X-2004.pdf和802.1X-2010.pdf

802.1x-2010标准（便宜1积分，内容都一样的）

802.1x协议（英文pdf）

IEEE Std 802.1AX-2020 局域网和城域网-链路聚合 - 完整英文电子版（333页）

IEEE Std 802.1AR-2018 局域网和城域网-确保设备身份安全 - 完整英文电子版（73页）

IEEE Std 802.1AE-2018 局域网和城域网-媒体访问控制（MAC）安全 - 完整英文电子版（239页）

IEEE Std 802.1CB-2017 局域网和城域网-帧复制和消除的可靠性 - 完整英文电子版（102页）

IEEE 802.1BA-2011/Cor1-2016 局域网和城域网-音频视频桥接 (AVB) 系统-完整英文电子版（13页）

IEEE Std 802.21-2017 局域网和城域网标准 - 第 21.1 部分：媒体独立服务 -完整英文电子版（314页）

IEEE 802.1Qbv-2015：局域网和城域网桥接网络增强调度流量标准

最新资源