Authentication Methods
The Cisco Wireless IP telephony solution provides wireless network security that prevents unauthorized
sign-ins and compromised communications by using the following authentication methods that the wireless
Cisco Unified IP Phone 9971 supports:
•
Open Authentication: Any wireless device can request authentication in an open system. The AP that
receives the request may grant authentication to any requestor or only to requestors that are found on a
list of users. Communication between the wireless device and AP could be nonencrypted or devices can
use Wired Equivalent Privacy (WEP) keys to provide security. Devices that use WEP only attempt to
authenticate with an AP that is using WEP.
•
Shared Key Authentication: The AP sends an unencrypted challenge text string to any device that attempts
to communicate with the AP. The device that is requesting authentication uses a preconfigured WEP
key to encrypt the challenge text and sends it back to the AP. If the challenge text is encrypted correctly,
the AP allows the requesting device to authenticate. A device can authenticate only if the device WEP
key matches the WEP key on the APs.
Shared key authentication can be less secure than open authentication with WEP because someone can
monitor the challenges. An intruder can calculate the WEP key by comparing the unencrypted and
encrypted challenge text strings.
•
Extensible Authentication Protocol-Flexible Authentication via Secure Tunneling (EAP-FAST)
Authentication: This client server security architecture encrypts EAP transactions within a Transport
Level Security (TLS) tunnel between the AP and the RADIUS server, such as the Cisco Access Control
Server (ACS).
The TLS tunnel uses Protected Access Credentials (PACs) for authentication between the client (phone)
and the RADIUS server. The server sends an Authority ID (AID) to the client (phone), which in turn
selects the appropriate PAC. The client (phone) returns a PAC-Opaque to the RADIUS server. The
server decrypts the PAC with the master key. Both endpoints now contain the PAC key and a TLS tunnel
is created. EAP-FAST supports automatic PAC provisioning, but you must enable it on the RADIUS
server.
In the Cisco ACS, by default, the PAC expires in one week. If the phone has an expired
PAC, authentication with the RADIUS server takes longer while the phone gets a new
PAC. To avoid PAC provisioning delays, set the PAC expiration period to 90 days or
longer on the ACS or RADIUS server.
Note
•
Light Extensible Authentication Protocol (LEAP): Cisco proprietary password-based mutual authentication
scheme between the client (phone) and a RADIUS server. Cisco Unified IP Phone can use LEAP for
authentication with the wireless network.
•
Auto (AKM): Selects the 802.11 Authentication mechanism automatically from the configuration
information that the AP, WPA-PSK, or WPA exhibits.
Authenticated Key Management
The following authentication schemes use the RADIUS server to manage authentication keys:
Cisco Unified IP Phone 8961, 9951, and 9971 Administration Guide for Cisco Unified Communications Manager
10.0 (SIP)
94
VoIP Wireless Network
Authentication Methods
REVIEW DRAFT - CISCO CONFIDENTIAL
