Scribd
Upload
5 views1 page

EAP-FAST Architectural Model Overview

The document describes the network architectural model for EAP-FAST usage. It shows the logical relationships between the peer, authenticator, EAP-FAST server, and inner method server. It notes that these logical entities may be combined in actual systems. It also defines a Protected Access Credential (PAC) which contains a shared secret, opaque element, and optional other information distributed to peers for future optimized authentication.

Uploaded by

api-3713843
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOC, PDF, TXT or read online on Scribd
5 views1 page

EAP-FAST Architectural Model Overview

The document describes the network architectural model for EAP-FAST usage. It shows the logical relationships between the peer, authenticator, EAP-FAST server, and inner method server. It notes that these logical entities may be combined in actual systems. It also defines a Protected Access Credential (PAC) which contains a shared secret, opaque element, and optional other information distributed to peers for future optimized authentication.

Uploaded by

api-3713843
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOC, PDF, TXT or read online on Scribd

Architectural Model Implemented in RF-4507 [Ticket]

The network architectural model for EAP-FAST usage is shown below:


+----------+ +----------+ +----------+ +----------+
| | | | | | | Inner |
| Peer |<---->| Authen- |<---->| EAP-FAST |<---->| Method |
| | | ticator | | server | | server |
| | | | | | | |
+----------+ +----------+ +----------+ +----------+

EAP-FAST Architectural Model

The entities depicted above are logical entities and may or may not
correspond to separate network components. For example, the EAP-
FAST server and inner method server might be a single entity; the
authenticator and EAP-FAST server might be a single entity; or the
functions of the authenticator, EAP-FAST server, and inner method
server might be combined into a single physical device. For example,
typical 802.11 deployments place the Authenticator in an access point
(AP) while a Radius server may provide the EAP-FAST and inner method
server components. The above diagram illustrates the division of
labor among entities in a general manner and shows how a distributed
system might be constructed; however, actual systems might be
realized more simply.
Protected Access Credential (PAC)

Credentials distributed to a peer for future optimized network


authentication. The PAC consists of, at most, three components: a
shared secret, an opaque element, and optionally other information.
The shared secret component contains the pre-shared key between the
peer and the authentication server. The opaque part is provided to the
peer and is presented to the authentication server when the peer
wishes to obtain access to network resources. Finally, a PAC may
optionally include other information that may be useful to the peer.
The opaque part of the PAC is the same type of data as the ticket in
[RFC 4507] and the shared secret is used to derive the TLS master
secret.

You might also like