A closer look at LEAP
 
|
|||
 | |||
|
In short, here's how Lightweight Extensible Authentication Protocol works: The client looks for beacons from a wireless access point. Beacons are broadcast by the wireless access point on a regular basis, announcing its presence and facilitating communication. When a client hears a beacon, it sends out a Dynamic Host Configuration Protocol request along with its service set identifier. Cisco's wireless access point will send the request to the ACS server, which sends a challenge-response back to the wireless access point, which forwards it to the client. If the client doesn't hear the appropriate challenge-response, it disassociates itself from that wireless access point and looks for another wireless access point. If the challenge-response is good, then the client sends a hash of the user's password based upon values stored in the client and the authentication server.
Once the client and the server have mutually authenticated one another, the session begins. If the association is lost, both are deauthenticated, and must repeat the process. The good thing is that this process is automatic. Although you can set the ACS server to reauthenticate as often as once every second, once per hour is more reasonable, and still ensures a high degree of security. If overhead is not a problem and your security concerns are substantial, you might find 60-second intervals quite reasonable.
RELATED LINKS
Janss is the president of Jansys Information Systems, a consulting firm specializing in IS technologies for small businesses. He can be reached at bizcom@jansys.com.
Wireless LAN security
The IEEE 802.11b Task Group I is working on a new standard that provides authentication and encryption for secure wireless networking. In the meantime, proprietary products that plug the holes in 802.11b security may be your best bet.
How we did it
Our testing methods ecplained.
IEEE is working on new standard
The scope of IEEE's 802.11b Task Group I is "to enhance the 802.11 Medium Access Control to enhance security and authentication mechanisms."
WEP's fatal flaw exposed
Wired Equivalent Privacy vulnerabilities came to light more than a year ago in October 2000.
