eap state machine
play

EAP State Machine Bryan D. Payne, Nick L. Petroni, Jr., & Chuk - PowerPoint PPT Presentation

EAP State Machine Bryan D. Payne, Nick L. Petroni, Jr., & Chuk Yang Seng University of Maryland, College Park 55 rd IETF November 2002 1 State Machine Revision http://www.ietf.org/internet-drafts/draft-payne-eap-sm-01.ps Update to a prior


  1. EAP State Machine Bryan D. Payne, Nick L. Petroni, Jr., & Chuk Yang Seng University of Maryland, College Park 55 rd IETF November 2002 1

  2. State Machine Revision http://www.ietf.org/internet-drafts/draft-payne-eap-sm-01.ps Update to a prior work (IETF 53) Changes based on design-team discussion • IEEE 802.1x notation • Nak handling • Identity handling Maryland Information Systems Security Laboratory http://www.cs.umd.edu/ ∼ npetroni/EAP/ietf55.pdf 2

  3. EAP Authenticator State Machine INITIALIZATION Policy.initialize() currentId = initialIdVal NEED ID UCT rxIdResp = FALSE idTimeout idTimeout = FALSE && needId txIdReq(currentId) GET METHOD idTryCount < maxIdTry inc(idTryCount) currentMethod = Policy.getNextMethod() needId = requiresId(currentMethod) rxIdResp idTryCount=0 UCT RECV ID idTryCount >= maxIdTry ELSE && inc(currentId) !rxIdResp POLICY TEST UCT policySat = Policy.isSatisfied() methodSuccess = FALSE methodFailure = FALSE currentMethod = NULL FAILURE && txFailure(currentId) !policySat inc(currentId) ELSE SUCCESS policySat RECV NAK txSuccess(currentId) Policy.recvNak(currentMeth) inc(currentId) rxNak METHOD INIT methodFailure rxNak = FALSE rxMethodResp = FALSE txMethodReq(currentId) rxMethodResp inc(currentId) METHOD BODY rxMethodResp = FALSE if(!isComplete(currentMethod)) { methodSuccess txMethodReq(currentId) inc(currentId) } rxMethodResp Maryland Information Systems Security Laboratory http://www.cs.umd.edu/ ∼ npetroni/EAP/ietf55.pdf 3

  4. EAP Peer State Machine INITIALIZATION Policy.initialize() UCT rxSuccess ID REQ && UNAUTHENTCATED SUCESS rxIdReq policySat txIdResp() rxIdReq = FALSE rxMethodReq = FALSE rxSuccess = FALSE rxFailure = FALSE UCT rxFailure policySat = Policy.isSatisfied() FAILURE methodSuccess = FALSE methodFailure = FALSE UCT rxMethodReq NAK METHOD INIT !doMethod txNak(currentMethod) doMethod = Policy.allowMethod(currentMethod) methodSuccess || methodFailure doMethod METHOD BODY rxMethodReq = FALSE txMethodResp() rxMethodReq Maryland Information Systems Security Laboratory http://www.cs.umd.edu/ ∼ npetroni/EAP/ietf55.pdf 4

  5. To Be Done Explicit representation of timers Error handling Alternate indications of Failure / Link changes Pass-through Authenticator Maryland Information Systems Security Laboratory http://www.cs.umd.edu/ ∼ npetroni/EAP/ietf55.pdf 5

  6. References http://www.ietf.org/internet-drafts/draft-payne-eap-sm-01.ps http://www.ietf.org/internet-drafts/draft-payne-eap-sm-01.txt http://www.ietf.org/internet-drafts/draft-ietf-eap-esteem-00.txt http://www.ietf.org/internet-drafts/draft-ietf-pppext-rfc2284bis-07.txt Maryland Information Systems Security Laboratory http://www.cs.umd.edu/ ∼ npetroni/EAP/ietf55.pdf 6

Recommend


More recommend