1. Wireless Authentication Update Terry Gray, U Wash Mark Poepping, CMU Frank Grewe, U Minn Common Solutions Group 11 Jan 01

2. 0. Agenda Background and Policy Issues (Terry) Protocol and Standards Issues (Mark) Practical Experience (Frank) Discussion (Y'all)

3. 1. Background and Policy Issues (What is the goal, and why?) Policy Problem Space Solution Space Motivations Tradeoffs

4. 1A. Policy Problem Space Is Wireless/Network Auth a Good Thing? If it is… Then shouldn't we authenticate all network access? Single Sign-On: bug or feature? Granularity of authorization (binary, or rich categories) Co-existence with departmental wireless stuff

5. 1B. Solution Space No network auth MAC address registration EAPOL/802.1x to RADIUS, LDAP, etc VPN/Firewall

6. 1C. Motivations for Network Auth Limiting use of network resource to approved users Traceability if something bad happens Cost recovery for (wireless) service

7. 1D. Motivations for not doing Network Auth User hassle End-system software management, if not built-into OS Debate over single-sign-on vs. add'l exposure of credentials Claims that NetAuth motivations may be weak or bogus Does it lead to authenticating *all* network connections?

8. 1E. Tradeoffs: MAC issues Plus: –Non-intrusive, after initial reg Minus –must allow multiple devices per user –must deal with initial registration problem –must deal with periodic re-registration –less stringent traceability

9. 1F. Tradeoffs: EAP vs. VPN/Firewall Industry trends Availability/support of client software Infrastructure implications, e.g. VLANs

10. 2. Protocol and Standards Issues (Mark)

11. 3. Practical Experience (Frank)

12. 4. Discussion (Y'all)