IEEE 802.1x Port based Network Access Control | PNAC

 

IEEE 802.1x Port based Network Access Control 

IEEE 802.1X is a port-based network access control mechanism used to prevent unauthorized devices from accessing a network.

It restricts unauthorized devices from connecting to a LAN or WLAN (Wi-Fi).

The authentication process commonly uses EAP (Extensible Authentication Protocol) and EAPOL (EAP over LAN).


Main Components of IEEE 802.1X:
1. Supplicant
 The Supplicant is the client device that needs to be authenticated before accessing the network. 
 Examples: Laptop, Mobile phone, PC 

2. Authenticator 
  • It acts as an intermediate device between the client and the authentication server.
  • It blocks normal network access until the user or device is successfully verified.
  • It forwards authentication-related messages between the supplicant and authentication server. 
Examples: Wi-Fi Router ,Network Switch 

3. Authentication Server 
 The Authentication Server is the backend server responsible for verifying the credentials supplied by the user or device. 
 Example: RADIUS Server



IEEE 802.1X – Port Control View

Supplicant         Authenticator               Server
(User Device)      (Switch / Router)         (RADIUS)

     |                                     |                              |
     |--- EAPOL Start --->                                                  
     |                                     | - Port Blocked -->|
     |<---- Identity Req         |                              |        
     |--- Identity Resp--->     |                              |           
     |                                      |   ---Forward --->  | 
     |                                      | <--- Challenge --- |  
                                             (Select EAP method)
     | <----- Challenge --       |                               |              
     |  ------ Credentials ---> |                               |              
     |                                      | ----- Verify ---->   |       
     |                                      |<---- Success/Fail  |
     |<--- Access Granted/    |   -- Unblock if --   |                          
                  Denied                        Success     
                                                                    


Phase 1 – Initialization (Port Blocking Stage)

  1. The client device (Supplicant) connects to a wired LAN or a Wi-Fi access point.
  2. The Authenticator (switch or access point Router), initially blocks normal data traffic.
  3. During this stage, only the required authentication messages are allowed through the port. 
         

Phase 2 – Authentication Start (EAPOL Communication)

  1. The client sends an EAPOL-Start message to indicate that it wants to begin the authentication process.
  2. The Authenticator responds with an EAP Request/Identity message.
  3. The client sends an EAP Response/Identity message containing its identity information, such as the username or device identity.

Phase 3 – Forwarding to Authentication Server
  1. 7.The Authenticator forwards the identity information received from the client to the Authentication Server, usually a RADIUS server. 


Phase 4 – Credential Verification(Challenge Process)

  1. The server sends an authentication challenge through the Authenticator.

The server selects an appropriate EAP authentication method depending on the network configuration.

Examples include:

  • PEAP
  • EAP-TLS
  • SIM-based authentication
  • Password-based authentication
  • Digital certificate-based authentication
  • OTP-based authentication
  1. The client responds to the challenge with the required credentials. Examples: Password, Certificate, Token, Other authentication information
  1. The Authentication Server securely verifies the credentials supplied by the client. 


Phase 5 – Authentication Result
  1. After verification, the Authentication Server sends the authentication result.

There are two possible results:

Success
                                               Success → Access Accept
The authentication server accepts the credentials and permits the authentication process to continue.

Failure
                                                  Failure → Access Reject
The authentication server rejects the credentials and the client is not allowed to obtain normal network access.



Phase 6 – Port Authorization

After receiving the authentication result, the Authenticator controls the network port.

If Authentication is Successful

  1. The network port becomes authorized.
  • The port is opened for normal communication.
  • Data traffic is allowed.
  • The authenticated client can access the network. 

If Authentication Fails

  1. The network port remains blocked.
  • Normal data traffic is not allowed.
  • The client cannot obtain network access. 

Phase 7 – Secure Communication

  1. After successful authentication, communication between the client and the network can proceed.

The authenticated client can now communicate with the network through the authorized port.


Advantages of IEEE 802.1X

  1. Provides strong access control
  2. Prevents unauthorized network entry
  3. Supports wired and wireless networks
  4. Improves enterprise security
 Handwritten Notes-Download PDF
Video Explanation-Watch on YouTube

Comments

Post a Comment

Popular posts from this blog

B+ Tree in DBMS | B+ Tree in Data Structure

    B+  Tree A B+ Tree is a self-balancing multi-way search tree   All leaf nodes are present at the same level . Actual data records are stored only in the leaf nodes . Internal nodes contain only search keys . It is mainly used for efficient searching and sequential access . B+ Tree supports efficient range queries . Structure of B+ Tree Consider a B+ Tree node containing keys and children: Number of Keys Number of Children 1 2 2 3 3 4 In general, Number of children = Number of keys + 1 The leaf nodes are connected sequentially using links( Linked List ). Rules of B+ Tree For a B+ Tree of order m : At most: A node can have at most m children . A node can contain at most m − 1 keys. At least: An internal node must have at least [ m/2 ] children . An internal node must contain at least [ m/2 ] − 1 keys . Insertion...
Read more

Hashing in Data Structure | Collision Resolution Techniques | Hashing in DBMS

  Hashing in DBMS Hashing is a technique used to map data elements (keys) to specific locations in a hash table using a hash function. It allows insertion and retrieval of data efficiently     Hash Function A hash function converts a key into a hash code (index) , which is used to store and retrieve the data from a hash table.                                 h(k)=k mod m Where: k → Key m → Hash table size h(k) → Hash index  Hash Table A hash table is a data structure that stores data in an array format . Each position in the table is called a bucket , and the position is accessed using the hash function. Example Consider Keys                   (k) = 11, 18, 20, 25, 29, 33 Hash table size (m) = 7 Hash function:    h(k)=k mod m                     ...
Read more

Normalization in DBMS,(1NF,2NF,3NF,BCNF,4NF,5NF)

                      Normalization in DBMS Normalization divides a large table into smaller , logically related tables and connects them using appropriate keys. The main purpose of normalization is to reduce unnecessary duplication of data and prevent problems that may occur when data is inserted, updated, or deleted. 1. First Normal Form (1NF) A relation is said to be in First Normal Form (1NF) when every attribute contains a single, indivisible value . Conditions of   1 NF Each cell must contain only one value. Multiple values should not be stored in the same field. ·         Example Customer Items Purchased Gowsi Rice, Dal Tamil Soap ·   Here, the Items Purchased column contains more than one value for Gowsi . ·   Therefore, the table is not in 1 NF . Converting it into 1NF. ...
Read more