Introducing Smartcard Enabled RADIUS Server

Abstract

This paper introduces an innovative concept of smartcard enabled RADIUS server. We design RADIUS servers in which EAP messages are fully processed by smartcards, called EAP-Servers. When the well known TLS protocol is used as authentication method, this architecture becomes scalable. In that case, concurrent authentication sessions are simultaneously handled by different EAP-Servers, each of them securely embeds an unique X509 certificate and its associated private key. We presents experimental results obtained with commercial components, and demonstrate that system performances, about 5 seconds per RADIUS session, are compatible with today network constraints.

Provedores de Identidade Resilientes e Confiáveis

“…Em resumo, a abordagem do OpenID-VR possui pelo menos dois desafios: (1) a escalabilidade do sistema, uma vez que grids de smart cards geram uma sobrecarga significativa ao processo de autenticação, que pode ultrapassar a 2 segundos [Urien and Dandjinou 2006], além de impactar significativamente na vazão do sistema; (2) tolerar apenas instruções relativas ao protocolo OpenID, ou seja, falhas de infraestruturas (físicas e/ou lógicas) não são suportadas. Além disso, o serviço de autenticação é um ponto único de falha.…”

Security and privacy for the next wireless generation

“…During an authentication session, EAP messages are exchanged between the EAP-client and EAP server, and are transported by various means, such as RADIUS packets or Wi-Fi frames. In 2006, the OpenEapSmartcard platform was slightly modifi ed [28] in order to support client and server features. By deploying EAP smart cards on both the client and server side, we reintroduced the classical (according to the smart card technologies) concept of SAMs (Secure Access Module) adapted to WLANs.…”

SECURE ACCESS MODULES FOR IDENTITY PROTECTION OVER THE EAP-TLS - Smartcard Benefits for User Anonymity in Wireless Infrastructures

“…In (Urien et al, 2004) and (Urien et al, 2006a), we described our implementation of EAP-TLS on EAP smartcards and detailed benchmark tests. The best results show that EAP-TLS session costs about five seconds on both on the client and server side.…”

“…If we call Tm the main thread that runs the RADIUS server and Ti a thread associated to a given EAP message, the EAP server management is therefore done according to the following paradigm: 1-In thread Tm, the GetSession() procedure finds a smartcard (whose number is index) that is associated or that can be associated to the EAP session, identified with its id-session value, see (Urien et al, 2006a) for more details. If no smartcard is available, then the incoming RADIUS Access-Request is silently discarded.…”