WIDE Paper-List in 2011

Network Access Authentication
Infrastructure Using EAP-TTLS on
Diameter EAP Application
wide-paper-aaa-eapttls-00.pdf

PROJECT

WIDE Project : http://www.wide.ad.jp/

If you have any comments on WIDE documents, please contact toboard@wide.ad.jp

Title:Author(s):Date:Network Access Authentication Infrastructure Using EAPTTLS on Diameter EAP Application
Yuki Atsuya, Souheil Ben Ayed, and Fumio Teraoka
2011-11-09

Network Access Authentication Infrastructure Using
EAP-TTLS on Diameter EAP Application
Yuki Atsuya

Graduate School of Scienceand Technology
Keio University
3-14-1 Hiyoshi, Kohoku-ku,
Yokohama, 223-8522, Japan

atie@tera.ics.keio.ac.jp

Souheil Ben Ayed

Graduate School of Scienceand Technology
Keio University
3-14-1 Hiyoshi, Kohoku-ku,
Yokohama, 223-8522, Japansouheil@tera.ics.keio.ac.jp

Fumio Teraoka

Faculty of Science andTechnology
Keio University
3-14-1 Hiyoshi, Kohoku-ku,
Yokohama, 223-8522, Japan

tera@ics.keio.ac.jp

ABSTRACT

1.

In our universal AAA (Authentication, Authorization, andAccounting) infrastructure project, we have already developed the implementations of Diameter Base Protocol andDiameter EAP Application. As part of this project, we developed the first open-source of an EAP-TTLS server on Diameter EAP Application for network access control. EAPTTLS is one of the authentication methods in EAP. EAPTTLS has two phases. In phase 1, the user authenticatesthe EAP-TTLS server by the certificate of the EAP-TTLS
server. In phase 2, the EAP-TTLS server authenticates theuser by user’s password transmitted through the secure tunnel established in phase 1. Our implementation supports several authentication methods in phase 2 such as PAP, CHAP,
MS-CHAP, and MS-CHAPv2. It was made sure that the
EAP-TTLS server worked correctly for several types of user
terminals such as Windows, Linux, iPad, and Android. The
evaluation results show that the processing time of the EAPTTLS server is short enough for practical use.

AAA (Authentication, Authorization, and Accounting) is an indispensable function for service providers toprovide users with services in the Internet. One of our
projects aims at building a universal AAA infrastructure for a multi-realm environment on which a service
provider can authenticate and authorize a user requesting a service via a trust chain between realms even if
the realm to which the user belongs and the realm towhich the service provider belongs do not have a directtrust relationship.
In the current Internet, RADIUS (Remote Authentication Dial In User Service)[13] is widely used for AAA.
Since RADIUS is originally designed for a single realm,
it has several problems if it is used in a multi-realm
environment. For example, RADIUS uses UDP as thetransport layer protocol and does not define a mechanism for secure and reliable message exchange; it does
not define a failover mechanism when a server crashes;it does not have server-initiated message exchange. Asa successor of RADIUS, Diameter Base Protocol[8] wasstandardized in the IETF. It is designed for a multirealm environment and solves the problems RADIUS
has. The function of Diameter Base Protocol is to exchange AAA information between a Diameter client anda Diameter server. Application specific functions aredefined as Diameter Applications on top of Diameter
Base Protocol in separate documents. For example, Diameter EAP Application[10] is defined for authentication and authorization for network access.
In our universal AAA infrastructure project, we havealready developed the first open source of Diameter
Base Protocol called freeDiameter[9] and the first open
source of Diameter EAP Application called DiamEAP[5].
EAP (Extensible Authentication Protocol)[4] is extensible so that newly defined authentication methods canbe added later. The package of DiamEAP includes
EAP-TLS[14], which supports mutual authentication
between the user and the Diameter server by exchang-Categories and Subject Descriptors
C.2.2 [Computer Systems Organization]: ComputerCommunication Networks, Network Protocols

General Terms
Design, Performance

Keywords
AAA, Diameter, EAP, EAP-TTLS

Permission to make digital or hard copies of all or part of this work forpersonal or classroom use is granted without fee provided that copies are
not made or distributed for profit or commercial advantage and that copies
bear this notice and the full citation on the first page. To copy otherwise, torepublish, to post on servers or to redistribute to lists, requires prior specificpermission and/or a fee.
AINTEC’11, November 9–11, 2011, Bangkok, Thailand.
Copyright 2011 ACM 978-1-4503-1062-8/11/11 ...$10.00.

INTRODUCTION

ing the certificates of both sides. Although EAP-TLS is
one of most secure authentication methods, it is a little
bit difficult to deploy EAP-TLS because it requires thatusers’ certificates be distributed to the users and thatthe user certificate be installed in user’s device.
On the other hand, EAP-TTLS[11] also supports mutual authentication but it does not require the user certificate for user authentication. EAP-TTLS has twophases. In phase 1, the EAP-TTLS server sends its
certificate to the user and the user authenticates the
EAP-TTLS server. In this phase, a secure tunnel is established between the user and the EAP-TTLS server.
In phase 2, the user can select one of EAP methods thatmight not be secure enough such as CHAP and senduser’s information such as the password to the EAPTTLS server through the secure tunnel. Since deployment of EAP-TTLS is easier than that of EAP-TLS,
several operating systems such as Windows, Linux, andAndroid support EAP-TTLS as user side network access control. However, as far as we know, there is no
open source of an EAP-TTLS server.
This paper describes the design, implementation, andevaluation of the EAP-TTLS server on Diameter EAP
Application. As far as we know, this implementationis the first open source of an EAP-TTLS server. It is
made sure that our EAP-TTLS server works correctlyfor several types of user terminals. The performance of
our EAP-TTLS server is also shown.

2. RELATED WORK
2.1 Eduroam
Eduraom (education roaming)[1, 6] is an internationalroaming service for members of different universities,
research institutions and educational organizations. In
the Eduroam architecture, users from these institutions
are able to access the Internet at any of the participatedinstitutions. Eduroam is a hierarchically federated service based on a number of technologies: principally the
RADIUS AAA protocol and the IEEE 802.1X technology. The principle of Eduroam control access is thatwhen a user tries to access the Internet, its credentials
are checked at the institution to which the user belongs.
Eduroam lacks some critical features such as for controlling user’s authorizations to access the Internet. In
addition, an institute may provide additional services
and resources for visitor users, however, after being authenticated successfully, the home institution and theinstitution providing Internet access are not exchanging
user’s attributes which can be useful for access-control
at service layers.

2.2 Shibboleth
Shibboleth[3, 12] is Internet2 federated identity management middleware focusing on educational institu-

tions. It is an open-source project based on Security
Assertion Markup Language (SAML)[2], an OASIS Security Services Technical Committee XML-based standard for creating and exchanging authentication andauthorization information, to protect online resourcesfrom unauthorized access. It also provides a federated
Single Sign-On (SSO) for web-based applications. The
Shibboleth protocol aims to allow federated organizations and different Service Providers (SPs) to manageand exchange information about shared resources. It
defines a set of interactions between a service provider
and an identity provider to facilitate exchange of attributes. Comparable to many other authentication
and authorization environments, the access control in
Shibboleth is based on user identity. However, the user
identity is not enough and more additional user information should be considered in making decision in order
to offer fine-grained access control and grant adequate
authorizations for accessing services.

3.

OVERVIEWS OF DIAMETER AND EAP

3.1

Diameter Architecture

3.1.1

Diameter Nodes

Diameter defines several kinds of nodes for use in a
multi-realm environment. The Diameter client is a nodethat sends AAA requests. An example of the Diameterclient is a NAS (Network Access Server). The Diameter
server is a node that handles AAA requests for a particular realm. The relay agent relays the Diameter messages without analyzing their contents. The proxy agent
relays the Diameter messages and it may modify the Diameter messages based on the policy of the realm. The
redirect agent does not forward the Diameter messages
but notifies the Diameter client, the relay agent, or theproxy agent of the routing information. The translation
agent performs protocol translation between Diameterand other AAA protocols such as RADIUS.
Figure 1 shows an example of Diameter nodes. There
are two realms: Realm-1 and Realm-2. Each realm has
its own Diameter server that handles AAA requests forthe realm, the relay or proxy agent for message routing to other realms, the redirect agent, and the NAS(Network Access Server) as the Diameter client. In
this example, a node node@realm-2 sends a network
access request to the NAS in Realm-1. The Diameter
Request and Answer messages are exchanged between
the Diameter client in Realm-1 and the Diameter server
in Realm-2 via the relay/proxy agents in Realm-1 andRealm-2. As a result, the node is authenticated andallowed to access the Internet.

3.1.2

Diameter Base protocol and Diameter Applications

34#%"2",/ !"#$%&'
5",6",!"$#)*+,-.)/#0"12!"A4,"72/#0"12#77"55/,"FG"52!"#$%&($%&'

34#%"2",/
5",6",!"$#)*+,-.)/#0"12!"A4,"72/#0"1234#%"2",/7$4"12*/8,#15$#9-1/#0"12/:";0;</=>?@

34#%"2",/7$4"12*/8,#15$#9-1/#0"12/:";0;</=>?@/"015&%;=2%&899:#4)))))?@+&2.)A&@@=*+,-&.&')/"015&67&%.4)))))/"015&%;=2%&);,%%.<'=7></"015&67&%.);,%%.<'=7><*+-&.&')/"01"2%3&'4)))))/"015&67&%.899:#4))))))))))#&'(&'A&@@=B)?&'CDE,.&/"015&%;=2%&899:#4)))))?<,2>&?+;<&'#;&EB)F+2+%<&G*+,-&.&')/"015&67&%.4)))))/"015&%;=2%&);,%%.<'=7><Figure 1: An example of Diameter nodes/"015&67&%.);,%%.<'=7><*+-&.&')/"01"2%3&'4)))))/"015&67&%.899:#4))))))))))?<,2>&?+;<&'#;&EB)F+2+%<&G

Diameter consists of Diameter Base Protocol[8] anda lot of Diameter applications such as Diameter EAP
Application[10]. At the Diameter Base Protocol level,
all the Diameter nodes are forming an overlay peerto-peer network with specific security, reliability, androuting properties. On top of this overlay network, Diameter applications are deployed. A Diameter application specifies the role of the different entities involvedin a particular service, and the different commands anddata that these entities exchange. For example, Diameter EAP Application defines some commands and data
for authentication and authorization of a node that tries
to connect to a network.

/"015&%;=2%&899:#4)))))"H0%*+,-&.&')/"015&67&%.4)))))/"015&%;=2%&);,%%.<'=7></"0I:4)))))/"01#7EE&%%*+,-&.&')/"01"2%3&'4)))))/"01#7EE&%%

3.2 EAP3.2.1 EAP Architecture
Extensible Authentication Protocol (EAP) is an authentication framework. It transports authentication
information and parameters between the user and theauthentication server. In addition, EAP provides functionalities for negotiation and selection of the appropriate authentication method among those proposed by
the both sides. EAP is not an authentication method;
it provides necessary functions and defines message formats for supporting authentication method.
The EAP standard was designed to be extensible byadding new EAP methods. It supports various authentication methods called EAP methods such as EAPMD5, EAP-TLS[14], EAP-TTLS[11], and EAP-PSK[7].
Many standards support EAP authentication methods,
such as IEEE 802.11, WPA and WPA2.

3.2.2 EAP-TLS
EAP-TLS is one of EAP methods that uses the TLS(Transport Layer Security) handshake to authenticate
the user and the authentication server. TLS provides
mutual authentication securely by exchanging the certificates of the user and the authentication server.
EAP-TLS authentication begins with the EAP-TLSStart message in the EAP-Request message sent by the

0<,%&)K*+,-&.&')/"01"2%3&'4)))))/"015&67&%.899:#1#.,'.

0<,%&)J/"015&67&%.);,%%.<'=7><=>?C/="2D-,E/>77"55/?",6",
1-A"B!"#$%&(#&'(&')!"#

Figure 2: EAP-TTLS sequence on Diameter
EAP Application

authentication server. Upon receiving the EAP-TLSStart message, the user responds with the Client Hellomessage in the EAP-Response message containing otherinformation such as the TLS version number, the session ID, the random number, and the set of cipher suites
supported by the user. Next, the authentication server
sends its certificate so that the user can authenticate
the authentication server. Next, the user also sends its
certificate so that the authentication server can authenticate the user.
The use of certificate makes great advantage for secure authentication. But it also makes disadvantage
for the cost of the infrastructure, because distributionof user certificates is required, and users need to bring
their own certificates when they use.

3.2.3

EAP-TTLS

EAP-TTLS uses the TLS handshake for server authentication while it uses a password based authentication method for user authentication. It is composed of
two phases as shown in Figure 2: phase 1 uses the TLS
handshake and phase 2 uses a password based authentication method through a secure tunnel.
In phase 1, the authentication server initiates the
EAP-TTLS method with the EAP-TTLS-Start message
in the EAP-Request message. Upon receiving this message, the user responds with the Client Hello message.
To complete the TLS handshake, exchange of EAP messages continues between the user and the authentication

server as shown in Figure 2. When phase 1 finishes, a
TLS tunnel is established between the user and the authentication server.
In phase 2, through this TLS tunnel established during phase 1, authentication message exchange will takeplace with another EAP method such as PAP, CHAP,
MS-CHAP, and MS-CHAPv2.

!

"

#

$

struct register_plugin{char *configure;char *init;
char *initPickUp;char *buildReq;
char *isDone;char *process;char *check;char *getTimeout;char *getKey;
char *unregister;char *datafree;char *authavp;};

4. FREEDIAMETER AND DIAMEAP
4.1 freeDiameter
freeDiameter[9] is an open source of Diameter Base
Protocol[8] developed in NICT (National Institute ofInformation and Communication Technology), Japan.
It is written in C and fully conforms to the specification.
As described in Sec. 3.1.2, Diameter Base Protocol is
responsible for reliable and secure exchange of Diameter
messages between the Diameter client and the Diameter server. Application specific functions are defined as
Diameter Applications such as Diameter EAP Application. In freeDiameter, a Diameter Application can be
added as an extension of freeDiameter.

4.2 DiamEAP
DiamEAP[5] is an implementation of Diameter EAP
Application developed in our laboratory. It is implemented as an extension of freeDiameter. It provides
functions in a Diameter server for authentication andauthorization of a user.
As described in Sec. 3.2.1, EAP is just a framework ofauthentication and authorization and practical authentication mechanisms are defined as EAP methods. DiamEAP is designed to make it possible to dynamicallyadd EAP methods such as EAP-TLS and EAP-TTLS
as plug-ins.
DiamEAP controls the EAP method plug-ins using
callback functions. By registering the functions in an
EAP method plug-in with DiamEAP as the callback
functions, DiamEAP will call the appropriate callback
function at each time. Figure 3 shows the entries of thecallback functions. The five main callback functions aredescribed bellow.

Config Function
When DiamEAP starts up, this function is called toread the configuration file of the EAP method plug-in.
This function can specify how to parse the configuration
file, which variable, e.g., certificate, loads its value fromthe configuration file.

Check Function
When DiamEAP receives an EAP packet that should beprocessed by the EAP method plug-in, this function iscalled. This function checks the format of the received
EAP packet.

Figure 3: Callback function entries in
DiamEAP

Process Function
This is the main function of the EAP method plugin. It is called after the check function. This function
performs the authentication process and sets the result
to the EAP state machine structure.

BuildReq Function
This function generates the EAP Request message according to the value in the EAP state machine.

getKey Function
Once the client is authenticated successfully, this function will be called. This function makes the mastersession key (MSK), which will be shared between the
network access server such as a WiFi access point andthe client.

5.

DESIGN AND IMPLEMENTATION OF EAPTTLS PLUG-IN

Our implementation of EAP-TTLS is designed as an
EAP method plug-in (EAP-TTLS Plug-in) in DiamEAP
as shown in Figure 4. The protocol stack composedof freeDiameter, DiamEAP, EAP-TTLS Plug-in, and
EAP-TLS Plug-in realizes a Diameter EAP server that
supports EAP-TTLS and EAP-TLS as EAP methods.
Hereafter, the Diameter EAP server that contains EAPTTLS Plug-in is called the EAP-TTLS server.
EAP-TTLS Plug-in is designed according to RFC
5281[11]. The supported authentication methods inphase 2 are PAP, CHAP, MS-CHAP, and MS-CHAPv2.
The user can choose an authentication method used inphase 2 from this list during the authentication process.
EAP-TTLS Plug-in does not need to configure whichauthentication method is used in phase 2 in advance.

5.1

Callback Functions

<*%'12+6>($%**#=%!

!"#$%&%'(12+((9%':%'(;29

int eap_ttls_configure(char *configfile)!"#$%&%'($%**#=%"

int eap_ttls_buildReq(struct eap_state_machine *smd,
u8 id, struct eap_packet *eapPacket))*+,--./0+123,%40)*+,-./0+123,%40

boolean eap_ttls_check(struct eap_state_machine *smd,
struct eap_packet eapRespData)

8(8(8!"#$%&%'(12+(233."-#4,5(/$%&')*+08(8(86&7%'(!"#$%&%'(
233."-#4,5*(!"#$%&%'()#*%(+',&,-,.(/!"##$%&'#(#"0

int eap_ttls_getKey(struct eap_state_machine *smd,
u8 **msk, int *msklen, u8 **emsk,
int *emsklen)

Figure 4: Position of EAP-TTLS Plug-in>*)?@4'96:"/";!"#$%&&'()*$+#*!3/&%'A'-)23%*+$/+#*
F%2G%;'()*$+#*,-!'./$0%*1'-)23%*+$/2#"'42/2%'
5/$36*%

76/8,-!

<#*HF'()*$+#*#

Figure 6: Definitions of callback functions in
EAP-TTLS Plug-in$

B&%"C&'
D*E#"8/+#*76/8,-!'96:<";=2
76/8,-!'$#88#*'
96:"/";

int eap_ttls_process(struct eap_state_machine *smd,
struct eap_packet eapRespData)<#*HF'(69%<3%$0'()*$+#*.)691I%J'()*$+#*,-!K??@4'=9)FK6*

Figure 5: EAP-TTLS Plug-in ArchitectureSec. 4.2 describes the interface between the DiamEAP
server and an EAP method plug-in. This section describes the details of each callback function from theviewpoint of EAP-TTLS Plug-in. Figure 5 shows themodule diagram of EAP-TTLS Plug-in and Figure 6
shows the definitions of the callback functions.
There is an important data structure, the eap statemachine structure. This structure is defined base on theEAP back end authenticator state machine[15] and used
for exchanging various information between DiamEAP
and EAP-TTLS Plug-in. It contains the user information registered with the user DB such as the user ID, thepassword, and the EAP method ID. It also contains avoid pointer methodData which points to the ttls data
structure used in EAP-TTLS Plug-in.
The ttls data structure is used in EAP-TTLS Plugin and maintains the authentication session, the current phase, the authentication method, and the fragmentation information. The fragmentation information
is used for fragmentation and reassembly of an EAP
packet.

Config Function
The config function is called when the DiamEAP server
starts up. As described before, in EAP-TTLS, the server

is authenticated with its certificate in phase 1 and theuser is authenticated with the password in phase 2. In
EAP-TTLS Plugin, the config function opens the EAPTTLS configuration file and reads several parameterssuch as server’s certificate, server’s secret key, and CA’s
(Certificate Authority) certificate.

Check Function
When freeDiameter receives a Diameter message that
contains the Diameter EAP Application AVPs, the Diameter message is passed to DiamEAP. Next, DiamEAP
retrieves an EAP packet from the AVPs contained in
the Diameter message. Hereafter, this procedure is described as “DiamEAP receives an EAP packet.”
When DiamEAP receives an EAP packet, it calls
the check function. The check function of EAP-TTLS
Plug-in checks that the EAP packet is not broken andwhether the type field contains the correct value thatspecifies EAP-TTLS (21).
For example, suppose that the EAP-TTLS server receives an EAP packet that contains three AVPs of MSCHAPv2: the User Name AVP, the MS-CHAP Challenge AVP, and the MS-CHAPv2 Response AVP. These
AVPs are encrypted by the TLS tunnel established inphase 1. The check function extracts just the type field
by using a DiamEAP library function diameap eap get type().
Then, the extracted type is checked whether the value
is correct or not. If it is correct, the check function
returns a boolean value TRUE.

Process Function
After the check function successfully finishes, the process function is called by DiamEAP. The process function of EAP-TTLS Plug-in is composed of three mainfunctions: the reassembly function, the phase 1 function, and the phase 2 function. The reassembly function reassembles the received fragments into the original

EAP packet by checking the fragment flag in the fragment. If an EAP packet is fragmented, the fragment
flag is set in each fragment except for the last fragment.
The phase 1 function and the phase 2 function use thelibCrypt library in DiamEAP and the GnuTLS library.
For EAP-TLS, DiamEAP provides a library for EAPTLS handshake processing. EAP-TTLS Plug-in alsouses this library in the phase 1 function. In phase 2, thereceived EAP packet is encrypted because it is transmitted through the TLS tunnel established in phase 1. The
phase 2 function decrypts the EAP packet and performs
the phase 2 authentication. When the phase 2 function
sends an EAP packet, it encrypts the EAP packet.
For example, suppose that the process function iscalled after the previous example in “check function.”
To decrypt the EAP packet, the process function uses a
DiamEAP library function diameap tls record receive().
After that, to extract the AVPs from the EAP packt,diameap eap ttls listAVPs() is used. Next, the process function decides which phase 2 authentication methodshould be used according to these AVPs and authenticates the user by the decided authentication method.
The result of authentication is set in the eap state machine
structure.

BuildReq Function
The buildReq function generates an EAP packet suchas the EAP-TTLS-Start message and the EAP-TTLSAck message for a fragmented EAP packet. The data
to be sent is generated based on the information in theeap state machine structure.

getKey Function
After the authentication processing successfully completes, the MSK (master session key) shared between
the user and the access point must be generated. According to RFC 5281, the getKey function of EAPTTLS Plug-in generates the MSK and the EMSK (extended MSK) by using GnuTLS library.

5.2 State Machine of the EAP-TTLS Plug-in
Figure 7 shows the state machine of EAP-TTLS Plugin. In the initialization phase, EAP-TTLS Plug-in reads
the configuration file and initializes the data for authentication session management, etc. After initialization, EAP-TTLS Plug-in moves to the phase 1 processing and waits for the first message from the user.
When EAP-TTLS Plug-in receives the first message,
it sends the TTLS-Start message to the user. After
that, EAP-TTLS Plug-in waits for the EAP-Response
message from the user. It continues the phase 1 processing until the Finished message is received. After
that, EAP-TTLS Plug-in moves to the phase 2 processing. It sends the request message to the user and waits
for the response message from the user. Upon receiving

!"#$"

B
3)14,5$/6'&1&78&9#7)1%#&"'()$'*!"'+!,$/3:'+!,'
0$)36'!/1;'<=->?"#$"%#&"'()$'-.#!/'*'$/!0)1!/$/3:'$/!0)1!/'
0$)36'!/1;'!533/!!A(#&85/$/3:'$/!0)1!/'
0$)36'!/1;'$/@!533/!!'0.#!/'*'
0$)36'!/1;'$/@6'/1"/$'0.#!/'2%#&"'()$'
0.#!/'2'$/!0)1!/Figure 7: State Machine of EAP-TTLS Plug-in
Table 1: Supported phase 2 authentication
methods and their AVPs
authentication method
PAP
CHAP

MS-CHAP
MS-CHAPv2

contained AVPs
User Name
User Password
User Name
CHAP Challenge
CHAP Password
User Name
MS-CHAP Challenge
MS-CHAP Response
User Name
MS-CHAP Challenge
MS-CHAPv2 Response

the response message, EAP-TTLS Plug-in performs thephase 2 authentication processing and sends the result(success or failure) message to the user.

5.3 Selection of Phase 2 Authentication Method
RFC 5281 does not specify how the user and the
EAP-TTLS server agree with the phase 2 authentication method. In our design, the phase 2 authentication
method is selected by checking the AVPs contained in
the EAP packets from the user in phase 2. Table 1 isthe list of the supported authentication methods andthe AVPs contained in each method. For example, if
the EAP-TTLS server receives the User Name AVP, theMS-CHAP Challenge AVP, and MS-CHAPv2 Response
AVP, EAP-TTLS Plug-in estimates that the user wants
to use MS-CAHPv2. If there are lacked or excess AVPs
in the received packets, EAP-TTLS Plug-in returns the
EAP-Failure message.

5.4 Implementation of MS-CHAPv2
As mentioned before, EAP-TTLS Plug-in supports

.$#3!""#$$%&'()*
0,123+!,-./0,(12#*#3%
41*#516+,!-./($%))#*%,(12#*#3%7!&%/#38#3$%&'5"(L$#8()*+&,&'M*,&3*N!"#()*+&,&'-."/-#&'0&'-!"#$%&%'($%))#*%

Figure 8: Evaluation environment5"(L$#-"EE&%%1?<*@@&2>&4----."/15&67&%,899:#1#,*',()*+&,&'-."/1"2%3&'4----."/15&67&%,899:#1#,*',."/15&%;=2%&899:#4----?@)&2,-A&@@=

5"(L$#-"EE&%%15&67&%,4----."/15&%;=2%&-;*%%,<'=7><()*+&,&'-."/15&67&%,4----."/15&%;=2%&-;*%%,<'=7><."/15&67&%,-;*%%,<'=7><5"(L$#-"EE&%%1?<*@@&2>&4----."/15&67&%,899:#4---------#&'0&'A&@@=B-?&'CDE*,&()+&,&'-."/1"2%3&'4----."/15&67&%,899:#4---------#&'0&'A&@@=B-?&'CDE*,&."/15&%;=2%&899:#4----?<*2>&?);<&'#;&EB-F)2)%<&G

5"(L$#-"EE&%%15&67&%,4----."/15&%;=2%&-;*%%,<'=7><()*+&,&'-."/15&67&%,4----."/15&%;=2%&-;*%%,<'=7><."/15&67&%,-;*%%,<'=7><()+&,&'-."/1"2%3&'45"(L$#-"EE&%%1?<*@@&2>&4----."/15&67&%,899:#4----."/15&67&%,899:#4---------?<*2>&?);<&'#;&EB-F)2)%<&G ---------?<*2>&?);<&'#;&EB-F)2)%<&G
5"(L$#-"EE&%%15&67&%,4----."/15&%;=2%&-;*%%,<'=7><()*+&,&'-."/15&67&%,4----."/15&%;=2%&-;*%%,<'=7><."/I:4----."/1#7EE&%%

5"(L$#-"EE&%%1"EE&;,4----."/1#7EE&%%()*+&,&'-."/1"2%3&'4----."/1#7EE&%%

Figure 9: Sequence of evaluataion
Table 2: Machine specification

6. EVALUATION
user
terminalThis section shows the working test and the performance of the EAP-TTLS server. In the measurement,
multiple operating systems are used as the user terminals. The result of the measurement is the average of 5
times tests.

6.2 Working TestFirst, the sequence of the EAP-TTLS server is checkedby capturing packets. As a result, it was made surethat the EAP-TTLS server authenticated the user inmachineThinkPad
X200s
iPad

NAS

6.1 Evaluation Environment
Figure 8 shows the evaluation environment. Several operating systems and devices such as Windows7,
Linux, iPad, and Android are employed as the user terminal. These operating systems and devices originally
support EAP-TTLS and are not modified for our test.
The EAP-TTLS server is installed in a Linux machine.
The NAS (Network Access Server) is an off-the-shelf
WiFi access point. The user terminal sends the EAP
packet to the NAS by EAPOL (EAP over LAN). The
NAS retrieves the EAP packet from the EAPOL packet
and encapsulates it in the RADIUS packet. Thus, since
there is no off-the-shelf WiFi access point that supports
Diameter, we employed the RADIUS/Diameter gateway that performs protocol conversion between RADIUS and Diameter. This gateway retrieves the EAP
packet from the RADIUS packet and encapsulates it in
the Diameter packet. Finally, the EAP packet reaches
the EAP-TTLS server. In the reverse path, the EAP
packet sent by the EAP-TTLS server is forwarded tothe user terminal by the Diameter packet, the RADIUS
packet, and the EAPOL packet. The specification ofeach machine is shown in Table 2.

/<*%&-K."/15&%;=2%&899:#4----"H/%/<*%&-J

PAP, CHAP, MS-CHAP, and MS-CHAPv2. As an example, this section describes the implementation of MSCHAPv2 in EAP-TTLS Plug-in. MS-CHAPv2 is a challenge handshake authentication protocol defined by Microsoft. The authentication process of MS-CHAPv2 isthe same as that of CHAP; it compares the user name,the challenge, and the password hashed by the challenge. Both the user and the server severally generates
the challenge. Since the challenge is generated by using the MSK (master session key) and random numbers
exchanged in phase 1, they can generate the same challenge.

."/15&67&%,-;*%%,<'=7><RADIUS/
Diamtergateway
EAP-TTLS
serverAllide Telesis
CentreCom8724SL V2
DELL
OPTIPLEX380
DELL
OPTIPLEX
380

CPU
Intel
Core2Duo
1.4GHzApple
A4 1GHz–Intel
Core2Quad
2.66GHzIntel
Core2Quad
2.66GHz

memory
4GB
256MB
–

4GB
4GB

the manner of the specification and that each message
contains the appropriate data. When the EAP-TTLS
server receives an illegal user name or password, it rejects authentication and returns Access-Reject. If the
NAS is configured as a DHCP server, the user terminal can obtain an IP address and access the Internet.
Table 3 shows the tested operating systems and devicesof the user terminal. It was made sure that all phase
2 authentication methods supported by the operating
systems or devices worked correctly.

6.3

Measurement of Authentication TimeThe time of entire EAP-TTLS authentication and thetime of phase 2 authentication were measured. The entire time is from the time when the EAP-TTLS server
sends EAP-TTLS-Start message to the time when the
EAP-TTLS server sends EAP-Success message. In EAPTTLS, each authentication method was measured. In
addition, the time of EAP-TLS authentication was alsomeasured for comparison.
As Table 4 shows, the time of the entire EAP-TTLS

Table 3: Confirmation of user terminals

phase 2authmethodPAP

CHAP
MS-CHAP
MS-CHAPv2

OS/device of user terminal
Windows Linux
Android
iPad
7
2.1
not
not
OK
OK
supported
supportedby Android
by iPad
not
not
OK
OK
supported
supportedby Android
by iPad
not
OK
OK
OK
supporedby iPad
OK
OK
OK
OK

Table 4: Authentication Time

EAP-TTLS
EAP-TLS

Phase 2 AuthmethodPAP
CHAP
MS-CHAP
MS-CHAPv2-

Total time
(msec)
16.39
16.06
16.02
15.83
29.08

Phase 2 time
(msec)
0.184
0.217
0.442
0.436
-

authentication is about a half of that of the EAP-TLS
authentication. Basically, authentication processing basedon certificate takes much longer time than that basedon password. The difference of authentication time of
EAP-TTLS and that of EAP-TLS is caused by the number of times of authentication processing based on certificate; EAP-TTLS performs certificate base authentication once while EAP-TLS performs certificate baseauthentication twice.
The time of the phase 2 authentication depends on
the authentication methods. The more complex the authentication method is, the longer the processing timeis. However, the differences are negligible from theviewpoint of practical use.

7. CONCLUSION
As part of our universal AAA project, the first open
source of EAP-TTLS is developed on Diameter EAP
Application for network access control. In EAP-TTLS,
the user authenticates the EAP-TTLS server by server’s
certificate while the EAP-TTLS server authenticatesthe user by the password transmitted through a TLS
tunnel. Currently, several operating systems and devices support EAP-TTLS. Our EAP-TTLS server works
correctly for several types of user terminals such as Windows7, Linux, Android, and iPad. The authentication
time of the EAP-TTLS server is short enough for practical use.

8. REFERENCES[1] eduroam home page. http://www.eduroam.org/.
[2] Security Assertion Markup Language (SAML)OASIS Standard. http://saml.xml.org/.

[3] Shibboleth home page.
http://shibboleth.internet2.edu/.
[4] B. Aboba, L. Blunk, J. Vollbrecht, J. Carlson,
and H. Levkowetz. Extensible Authentication
Protocol (EAP), June 2004. RFC 3748.
[5] S. B. Ayed and F. Teraoka. DiamEAP: an
Open-Source Diameter EAP Application and Its
Evaluation. In Proceedings of the 16th
Asia-Pacific Conference on Communications(APCC 2010), October-November 2010.
[6] F. Bernal, M. Sánchez, G. López, A. F.
Gómez-Skarmeta, and O. Cánovas. Trusted
Network Access Control in the eduroam
federation. In Proceedings of 2009 3rdInternational Conference on Network and System
Security (NSS’09), pages 170–175, October 2009.
[7] F. Bersani and H. Tschofenig. The EAP-PSK
Protocol: A Pre-Shared Key Extensible
Authentication Protocol (EAP) Method, January
2007. RFC 4764.
[8] P. Calhoun, J. Loughney, E. Guttman, G. Zorn,
and J. Arkko. Diameter Base Protocol, September
2003. RFC 3588.
[9] S. Decugis and F. Teraoka. freeDiameter: An
Open Source Framework for an Authentication,
Authorization, and Accounting Infrastructure.
JSSST Computer Software, 2011. (to appear).
[10] P. Eronen, T. Hiller, and G. Zorn. Diameter
Extensible Authentication Protocol (EAP)
Application, August 2005. RFC 4072.
[11] P. Funk and S. Blake-Wilson. Extensible
Authentication Protocol Tunneled Transport
Layer Security Authenticated Protocol Version 0(EAP-TTLSv0), August 2008. RFC 5281.
[12] W. Jie, A. Young, J. Arshad, J. Finch,
R. Procter, and A. Turner. A Guanxi Shibboleth
based Security Infrastructure for e-Social Science.
In Proceedings of 2008 12th Enterprise Distributed
Object Computing Conference Workshops, pages
151–158, September 2008.
[13] C. Rigney, S. Willens, A. Rubens, and
W. Simpson. Remote Authentication Dial In User
Service (RADIUS), June 2000. RFC 2865.
[14] D. Simon, B. Aboba, and R. Hurst. The
EAP-TLS Authentication Protocol, March 2008.
RFC 5216.
[15] J. Vollbrecht, P. Eronen, N. Petroni, and
Y. Ohba. State Machines for Extensible
Authentication Protocol (EAP) Peer andAuthenticator, August 2005. RFC 4137.