AAA and Network Security for Mobile Access: Radius, Diameter, EAP, PKI and IP Mobility

6.3. RADIUS Operation Examples

Now that we have covered the basics and messaging formats, let us go through some examples of RADIUS operation. We start this by going through the most classic applications of RADIUS that use RADIUS for password-based user authentication. After going through PAP and CHAP, we will go through the use of RADIUS for EAP. The discussion on interaction between EAP and RADIUS in this chapter will be rather brief. Instead we provide a lot of details on this interaction in Chapter 10, where the EAP-based authentication methods are discussed.

6.3.1. RADIUS Support for PAP

We discussed the use of Point to Point Protocol (PPP) in establishing dial-up connections for remote users in Chapter 2. The use of user passwords in the Password Authentication Protocol (PAP) was the most prominent way of performing user authentication. Initially the dial-up facilities had the ability to authenticate the users, but later on the arrangement was expanded so that the PPP users could authenticate to a backend authentication server. When RADIUS servers are used as backend server, the PAP is performed as follows:

• When a user tries to establish a PPP connection with the NAS and is configured to use PAP, the NAS prompts the user for user name and password.

• Upon receiving user name and password from the user, the NAS creates an Access Request message for the server as follows: The NAS creates a Request Authenticator (RA) and uses the RA and the shared secret it shares with the RADIUS ...