RADIUS protocol implementation for WLAN authentication and security

Diameter vs. RADIUS protocols

Implications of Diameter and RADIUS on Network Security

The Remote Authentication Dial-in Service (RADIUS) Server was primarily designed to accomplish three specific areas of network and Wide Area Local Area Network (WLAN) security process performance. These three areas the RADIUS protocol is based on are authentication, authorization, and accounting of WLAN traffic. Originally designed to enable WLANs to be more effectively managed (Wirbel, 2004) and secure (Hulme, 2002). The RADIUS protocol is specifically designed to bridge the security requirements between network-based security and user-based authentication (McFedries, 2004). As a result of these factors and the unique role of RADIUS servers based on this protocol, they are predominantly used by Internet Service Providers (ISPs). Having initially been created for providing authentication services throughout a WLAN, the RADIUS protocol progressed from their initial definition 1992 to in 1995 being substantive enough in December 1995 to have a working group established in the IETF. From this initial development, the RADIUS Server standard was issued an initial RFC in January 2007 (Curran, Canning, 2007) as RFC (2039) and upgraded RADIUS RFC (2865) was issued in June of 2000. The development of the RADIUS standard has since seen many vendors implement and tailor the standard to their individual requirements (Wangerien, 2006) including IBM, Lucent, Microsoft, Sun Microsystems, and many networking devices and software vendors. The intent of this paper is to explain the RADIUS protocol and how it accomplishes its three main objectives of providing authentication, authorization, and accounting throughout WLANs configurations, ensuring their security in the process.

Diameter and RADIUS Server Design Objectives

The three main design objectives of both the Diameter and RADIUS protocols are authentication, authorization and accounting (AAA) (Molta, Kozup, 2005) and serve as the foundation of the functional areas of this standard. Each of these areas is briefly defined in this section.

First, authentication is accomplished in both server protocols using constraint-based logic to determine whether users are eligible for requested services (Karyotis, Papavassiliou, 2007). The RADIUS protocol is differentiated from other services by having authentication information stored in the database cache or the local user file. Microsoft's Windows XP and 2000 Series Server operating systems vary in their approach (Ashley, 2004), with these operating systems relying on the development of internal authentication mechanisms while UNIX operating systems rely on external authentication mechanisms throughout this phase of workflows based on both standards (Cox, 2004).

Authorization is a second design objective of the Diameter and RADIUS protocols and defines controls for accessing specific services on the network and also for staying connected to a network of a given period of time. This specific design objective has lead to the development of a series of functions within the RADIUS protocol that treat IP addresses as a perishable access privilege (Karyotis, Papavassiliou, 2007), working in much the same way as the Dynamic Host Configuration Protocol (DHCP) uses a series of leased IP addresses that are provided to individual logins for a specific period of time. The RADUIS protocol refers to this concept of leasing IP addresses as the definition of Access Points (Wangerien, 2006).

The third design objective of ensuring accounting which is a form of an audit trial of the users of a network is typically used by ISPs to manage their billing services. Once a user has been authenticated, their date and time logged on and duration of their use is cataloged and then recorded into an accounting log. Only after a stop record is created from the activity in the online session does the log file end. ISPs have begun to use databases to capture the usage information so it would be possible to automate this entire process as well.

There is also the development of a series of analytics applications that can develop trending analysis (Molta, 2005) to also show the full activity of the entire ISP, in addition to differentiating the class of service and also isolating the most active users of the network as well (Titmus, 2006). As a result of the increased demand for analytics and the development of auditing process workflows based on Business Process Management (BPM) software infrastructures, ISPs and companies running RADIUS protocol have also installed configurations where the actual RADIUS protocol runs independently of authentication and authorization (Hulme, 2002). This is done to allow greater use of analytics applications to manage and audit the start and end of sessions, in addition to the amount of resources including the time take, packets sent and received, bytes of data overall, and any additional billing or usage metrics the ISP has defined for use (Karyotis, Papavassiliou, 2007). As a result of the de-coupling of the RADIUS protocol itself from the accounting features, there has been a corresponding increase in the depth and complexity of the accounting, usage reporting and financial reporting functionality possible based on this standard. ISPs are also using this accounting data to specifically address the sale of add-on or incremental services, using the unique approach that the RADIUS protocol relies on for authentication, which is based on the shared-secret model. None of the shared-secret code or data sent over the network, instead there is a matching algorithm used on both client and server to authenticate the identity of a user. From this approach to authentication through a shared-secret model, ISPs are able to validate who specifically is charging incremental services to their account.

Diameter's Advantages over RADIUS protocol

There are several design shortcomings of the RADIUS protocol that the Diameter protocol has specifically designed to address. As the RADIUS protocol was created in the mid-1990s there have been exponential increases in the complexity and sophistication of security threats (Wirbel, 2004), in addition to the development of entirely new networking and Internet-enabled devices (Molta, 2005) that has forced the development of a more thorough and timely protocol. The following are the key areas that the Diameter protocol addresses that are shortcomings of the RADIUS protocol.

First the RADIUS protocol has a limited size to its attribute data to support a maximum value of 255 versus 16 million octets in a given field value (Wangerien, 2006). This has given ISPs and those implementing Diameter-based networks orders of magnitude more flexibility in terms of defining security and configuration. Second, the RADIUS protocol has a limitation in the ability to manage the control flow of servers internally as it is based on the UDP protocol. As the RADIUS protocol is a connectionless protocol it is low-level in terms of its functionality and cannot support the more complex unmet needs of WLANs and ISPS today (Wirbel, 2004). Conversely, Diameter supports the Transmission Control Protocol (TCP) and the Stream Control Transmission Protocol (SCTP) have the functionality necessary to provide connection-oriented controls over flow control and arbitrating packets across the network. This is one the most significant limitations of the RADIUS protocol that is leading to widespread adoption of the Diameter protocol.

Limited server failure check in due to the RADIUS protocol being based on a NAS-based architecture, silent discarding of packets (Karyotis, Papavassiliou, 2007), and inefficient server-fail-over due to the NAS-based architecture all have lead to broader acceptance and adoption of the Diameter protocol. From a security standpoint, it's been proven that the RADIUS protocol's reliance on NAS as the basis of its structure also allows for impersonation attacks as well, a serious security threat (Wirbel, 2004). There requirement of the RADIUS protocol for a mandatory shared secret also imposed significant burdens on the network administrators, and the lack of end-to-end security in the RADIUS protocol also are factors in the development of the Diameter protocol and its popularity over the RADIUS protocol.

The advantages of the Diameter protocol include the following. First there is better support of proxy management in larger WLAN configurations, including an improvement in the development of network hop-to-hop transport failure detection (Wangerien, 2006). There is also greater support for proxy server managing the retransmission of pending requests, using a specific parameter for the number of retries as well. The most fundamental changes in the Diameter protocol over the RADIUS protocol include support for both the TCP and SCTP protocols, transmission of lost packets, and support for packet re-routing and networking optimization through the TCP and SCTP protocols serving as the foundation of this network protocol. The Diameter protocol was also specifically designed to provide greater compatibility with the IPSEC protocol, prevalent in VPN configurations due to its more advanced support of wireless security. There is also support for more advanced and layered proxy server configuration strategies that were an unmet need of larger WLAN users with regard to the RADIUS protocol. Finally, the Diameter protocol is more adept at session management and more effective accounting and analytics as its functional definition completes the preliminary steps the RADIUS protocol took to separate connection from accounting functions. Diameter servers, compatible with both the TCP and SCTP protocols, also support a greater level of flexibility in creating scenarios were session termination authentication and re-authorization are completed independently of the session management functions.

Summary

The transition from the RADIUS protocol to the Diameter protocol has as it catalyst the greater flexibility and security the latter protocol provides, specifically over TCP and SCTP-based networks. The shortcomings of the RADIUS protocol are addressed in the design of the Diameter protocol, with specific attention paid to the need for higher levels of security and agility in defining network configurations. The implications for ISPs and those companies creating WLANs include greater support for wireless security configuration, and therefore greater flexibility and independence for their users in using their wireless and IEEE 802.11i devices on networks configured using the Diameter protocol.