EAP State Machine Bryan D. Payne, Nick L. Petroni, Jr., & Chuk Yang Seng University of Maryland, College Park 55 rd IETF November 2002 1
State Machine Revision http://www.ietf.org/internet-drafts/draft-payne-eap-sm-01.ps Update to a prior work (IETF 53) Changes based on design-team discussion • IEEE 802.1x notation • Nak handling • Identity handling Maryland Information Systems Security Laboratory http://www.cs.umd.edu/ ∼ npetroni/EAP/ietf55.pdf 2
EAP Authenticator State Machine INITIALIZATION Policy.initialize() currentId = initialIdVal NEED ID UCT rxIdResp = FALSE idTimeout idTimeout = FALSE && needId txIdReq(currentId) GET METHOD idTryCount < maxIdTry inc(idTryCount) currentMethod = Policy.getNextMethod() needId = requiresId(currentMethod) rxIdResp idTryCount=0 UCT RECV ID idTryCount >= maxIdTry ELSE && inc(currentId) !rxIdResp POLICY TEST UCT policySat = Policy.isSatisfied() methodSuccess = FALSE methodFailure = FALSE currentMethod = NULL FAILURE && txFailure(currentId) !policySat inc(currentId) ELSE SUCCESS policySat RECV NAK txSuccess(currentId) Policy.recvNak(currentMeth) inc(currentId) rxNak METHOD INIT methodFailure rxNak = FALSE rxMethodResp = FALSE txMethodReq(currentId) rxMethodResp inc(currentId) METHOD BODY rxMethodResp = FALSE if(!isComplete(currentMethod)) { methodSuccess txMethodReq(currentId) inc(currentId) } rxMethodResp Maryland Information Systems Security Laboratory http://www.cs.umd.edu/ ∼ npetroni/EAP/ietf55.pdf 3
EAP Peer State Machine INITIALIZATION Policy.initialize() UCT rxSuccess ID REQ && UNAUTHENTCATED SUCESS rxIdReq policySat txIdResp() rxIdReq = FALSE rxMethodReq = FALSE rxSuccess = FALSE rxFailure = FALSE UCT rxFailure policySat = Policy.isSatisfied() FAILURE methodSuccess = FALSE methodFailure = FALSE UCT rxMethodReq NAK METHOD INIT !doMethod txNak(currentMethod) doMethod = Policy.allowMethod(currentMethod) methodSuccess || methodFailure doMethod METHOD BODY rxMethodReq = FALSE txMethodResp() rxMethodReq Maryland Information Systems Security Laboratory http://www.cs.umd.edu/ ∼ npetroni/EAP/ietf55.pdf 4
To Be Done Explicit representation of timers Error handling Alternate indications of Failure / Link changes Pass-through Authenticator Maryland Information Systems Security Laboratory http://www.cs.umd.edu/ ∼ npetroni/EAP/ietf55.pdf 5
References http://www.ietf.org/internet-drafts/draft-payne-eap-sm-01.ps http://www.ietf.org/internet-drafts/draft-payne-eap-sm-01.txt http://www.ietf.org/internet-drafts/draft-ietf-eap-esteem-00.txt http://www.ietf.org/internet-drafts/draft-ietf-pppext-rfc2284bis-07.txt Maryland Information Systems Security Laboratory http://www.cs.umd.edu/ ∼ npetroni/EAP/ietf55.pdf 6
Recommend
More recommend