IEEE 802.1X-2010：端口访问控制标准详解

802.1X-2010

5星 · 超过95%的资源需积分: 46 201 浏览量更新于2024-07-25 收藏 1.97MB PDF 举报

"802.1X-2010是IEEE发布的一项标准，全称为IEEE Standard for Local and metropolitan area networks — Port-Based Network Access Control，主要用于实现基于端口的网络访问控制。该标准的2010版是对2004版的修订，旨在为网络管理员提供一种机制，限制对IEEE 802®局域网服务接入点（端口）的使用，确保仅认证和授权的设备间进行安全通信。" 802.1X协议的核心在于通过端口级别的访问控制来增强网络的安全性。它定义了一种通用架构，包括功能性元素和协议，这些协议支持同一局域网内连接端口的客户端之间的相互认证，以及端口间的安全通信，包括用于发现和建立安全关联的媒体访问控制方法独立协议。在802.1X协议中，主要涉及三个关键角色：请求者（Supplicant），通常指的是试图接入网络的设备；认证服务器（Authenticator），这通常是网络边缘的设备，如交换机或无线接入点；以及身份验证实体（Authentication Server），这通常是网络上的一个中央管理服务器，例如 Radius 服务器。协议流程大致如下： 1. 请求者尝试访问网络，向认证服务器发送请求。 2. 认证服务器收到请求后，将认证请求转发给身份验证实体。 3. 身份验证实体根据预设的策略对请求者进行认证，可能包括用户名/密码、证书或其他凭证。 4. 如果认证成功，身份验证实体将结果通知认证服务器，认证服务器允许请求者通过端口接入网络；若认证失败，则拒绝请求。 802.1X协议不仅适用于有线网络，也支持无线网络。在无线环境中，它能够提供与有线网络相同级别的安全控制，确保只有经过验证的设备可以接入网络并进行通信。 802.1X-2010标准还引入了增强的安全功能和更新的技术，以适应不断发展的网络安全威胁。例如，它可能包含了对EAP（Extensible Authentication Protocol）的扩展支持，EAP是一种灵活的身份验证协议，可以适应多种不同的认证方法。 802.1X-2010标准对于企业网络环境尤其重要，因为它提供了精细的访问控制，有助于防止未经授权的设备接入网络，保护网络资源免受潜在攻击。同时，它也为网络管理员提供了管理和监控网络接入的工具，以维护网络的稳定性和安全性。

Tables

Table 5-1 System recommendations ..................................................................................................... 18

Table 9-1 MKA Algorithm Agility parameter values........................................................................... 64

Table 9-2 Key Server Priority values.................................................................................................... 67

Table 9-3 MKA Participant timer values .............................................................................................. 75

Table 10-4 Announcement performance parameters .............................................................................. 84

Table 11-1 EAPOL group address assignments...................................................................................... 88

Table 11-2 EAPOL Ethernet Type assignment....................................................................................... 89

Table 11-3 EAPOL Packet Types ........................................................................................................... 90

Table 11-4 EAPOL Packet Type Destination Addressing ...................................................................... 92

Table 11-5 Descriptor Type value assignments ...................................................................................... 95

Table 11-6 MKA parameters—fixed width encoding............................................................................. 97

Table 11-7 MKPDU parameter sets ........................................................................................................ 98

Table 11-8 EAPOL-Announcement TLVs ........................................................................................... 104

Table 11-9 Access Information ............................................................................................................. 106

Table 13-1 Use of ifGeneralInformationGroup objects ........................................................................ 127

Table 13-4 PAE managed object cross-reference table ........................................................................ 128

Table 13-2 Use of ifCounterDiscontinuityGroup Object...................................................................... 128

Table 13-3 Use of ifStackGroup2 Objects ............................................................................................ 128

Table 13-5 PAC managed object cross-reference table ........................................................................ 134

Table C-1 State machine symbols........................................................................................................ 194

IEEE Std 802.1X-2010 IEEE STANDARD FOR LOCAL AND METROPOLITAN AREA NETWORKS

1.3 Introduction

The stations attached to an IEEE 802 LAN transmit and receive data frames using the service provided by

the IEEE 802 LAN MAC at a service access point, often referred to as a port, within each end station or

bridge. Port-based network access control specifies a common architecture comprising cooperative

functional elements and protocols that

a) Use the service provided by the LAN MAC, at a common service access point, to support a

Controlled Port that provides secure access-controlled communication and an Uncontrolled Port that

supports protocols that initiate the secure communication or do not require protection.

b) Support mutual authentication between a Port Access Entity (PAE) associated with a Controlled

Port, and a peer PAE associated with a peer port in a LAN attached station that desires to

communicate through the Controlled Port.

c) Secure the communication between the Controlled Port and the authenticated peer port, excluding

other devices attached to or eavesdropping on the LAN.

d) Provide the Controlled Port with attributes that specify access controls appropriate to the

authorization accorded to the peer station or its user.

This standard specifies the use of EAP, the Extensible Authentication Protocol (IETF RFC 3748 [B14]

), to

support authentication using a centrally administered Authentication Server and defines EAP encapsulation

over LANs (EAPOL, Clause 11) to convey the necessary exchanges between peer PAEs attached to a LAN.

Where communication over the LAN connecting a Controlled Port to its peer(s) is physically secure, no

additional protocol is required to protect their communication. This mode of operation is supported by this

standard. More commonly intrusion into the LAN communication is a principal security threat, and the

result of mutual authentication is not simply Controlled Port authorization to transmit and receive data, but

secure distribution of master keys and associated data to the communicating peers. Proof of possession of

master keys subsequently serves as proof of mutual authentication in key agreement protocols. These

protocols generate keys that are used to cryptographically protect data frames transmitted and received by

the Controlled Port. IEEE Std 802.11™ Wireless LANs specifies protocols that associate wireless stations

with access points and initiate mutual authentication using the procedures specified in this standard, the

subsequent generation of keys to protect data transfer, and the cryptographic methods that protect data

frames using those keys. IEEE Std 802.1AE MAC Security (MACsec) specifies cryptographic support of

the Controlled Port for other media access methods. Authenticated key agreement for MAC Security, as

specified in this standard, specifies the generation of the Secure Association Keys (SAKs) used by MACsec.

Use of the Controlled Port can be restricted by access controls bound to the results of authentication and

distributed via AAA protocols such as Diameter (IETF RFC 3588 [B13]) or RADIUS (IETF RFC 2865

[B8]). Attributes supporting certain port-based network access control scenarios are described in IETF RFC

3580, IETF RFC 4675, and IETF RFC 4849.

Clause 7 illustrates use of the above components and protocols in typical network access control scenarios.

1.4 Provisions of this standard

The scope (1.1) of this standard is addressed by detailed specification of the following:

a) The principles of port-based network access control operation, identifying the protocol components

that compose a port-based network access control implementation (Clause 6).

The numbers in brackets correspond to those of the bibliography in Annex B.

PORT-BASED NETWORK ACCESS CONTROL IEEE Std 802.1X-2010

b) A PAE component, that supports authentication, authorization, and the key agreement functionality

required by IEEE Std 802.1AE to allow a MAC Security Entity (SecY) to protect communication

through a port (6.3, Clause 12).

c) A Port Access Controller (PAC) component, that controls communication where the attached LAN

is deemed to be physically secure and provides point-to-point connectivity (6.4).

d) The key hierarchy used by the PAE and SecY (6.2).

e) The use of EAP by PAEs to support authentication and authorization using a centrally administered

Authentication or AAA Server (Clause 8).

f) An encapsulation format, EAPOL, that allows EAP Messages and other protocol exchanges to

support authentication and key agreement to be carried directly by a LAN MAC service (Clause 11).

g) A MAC Security Key Agreement protocol (MKA) that the PAE uses to discover associations and

agree the keys used by a SecY (Clause 9).

h) An EAPOL Announcement protocol that allows a PAE to indicate the availability of network

services, helping other PAEs to choose appropriate credentials and parameters for authentication and

network access (Clause 10).

i) Requirements for management of port-based access control, identifying the managed objects and

defining the management operations for PAEs (12.9).

j) SMIv2 MIB objects that can be used with SNMPv3 to manage PAEs (Clause 13).

The use of port-based network access control in a number of applications is described (Clause 7) to illustrate

the use of these components and the requirements taken into account in their specification. To facilitate

migration to this standard, Annex G (informative) uses the same concepts to describe the architectural

modeling of unsecured multi-access LANs, a widely deployed form of authenticated port-based network

access control that does not meet the security requirements of this standard. Administrative connectivity to

unauthenticated devices, as required for use of industry standard ‘Wake-on-LAN’ (WoL) protocols, is

described for the scenarios of Clause 7; Annex F (informative) provides background information on WoL.

This standard defines conformance requirements (Clause 5) for the implementation of the following:

k) Port Access Entities (PAEs)

l) Port Access Controllers (PACs)

Annex A provides PICS (Protocol Implementation Conformance Statement) Proformas for completion by

suppliers of implementations that are claimed to conform to this standard.

The basic architectural concepts, such as ‘port’, that this standard relies on are reviewed in Annex D.

This standard uses and selects options provided by EAP and AAA protocol specifications, but does not

modify those specifications (see Clause 2 for references). Annex E (informative) provides EAP and

RADIUS usage guidelines.

The specification and conformance requirements for association discovery and key agreement for IEEE

802.11 Wireless LANs are outside the scope of this standard (see IEEE Std 802.11). That standard makes use

of the PAE specified by this standard.

剩余221页未读，继续阅读

雜貨鋪老闆

粉丝: 179
资源: 9

IEEE 802.1X-2010：端口访问控制标准详解

802.1X-2004.pdf和802.1X-2010.pdf

802.1x-2010标准（便宜1积分，内容都一样的）

IEEE 802.1X-2010 局域网和城域网.基于端口的网络通路控制

802.1x-2020

ieee std 802.1x-2020

802.1x-2001

802.1x vlan

华为 WLAN802.1x动态下发vlan配置（AC篇）

python 802.1x

802.1x发展历程

最新资源