Implement a Secure Login Protocol in C
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
EAP-TLS Authentication with an NPS RADIUS Server
EAP-TLS Authentication with an NPS RADIUS Server 802.1X/EAP-TLS (Extensible Authentication Protocol-Transport Layer Security), defined in RFC 5216, provides secure authentication methods. Client devices (RADIUS supplicants) and a RADIUS authentication server verify each other's identity by validating the signature on the computer and server certificates that they send one another. This authentication method uses an infrastructure that includes a RADIUS authentication server that communicates with an external LDAP database. It also needs a mechanism for installing certificates on the server and all the supplicants, which you can do with a Windows NPS (Network Policy Server) using a GPO (Group Policy Object) to distribute computer certificates and an 802.1X SSID client configuration for wireless access. You can also employ the same infrastructure to authenticate users (also referred to as RADIUS supplicants) who submit user names and passwords to the authentication server. This document explains how to set up the following components to provide wireless client and user authentication through 802.1X/EAP-TLS: • (Aerohive) An 802.1X SSID that instructs APs (RADIUS authenticators) to forward authentication requests to an NPS RADIUS server • (Windows) An NPS RADIUS server that accepts authentication requests from the APs and EAP-TLS authentication requests from clients • (Windows) A GPO to deploy computer certificates and a wireless network configuration to clients • (Aerohive and Windows – optional) An Aerohive and NPS configuration in which different RADIUS attributes are returned based on authentication method (EAP-TLS or PEAP-MS-CHAPv2 in this example) assigning one user profile to clients authenticating by certificate and another to users authenticating by user name/password. -
Utility-Grade Core Network Services
WHITEPAPER Utility-Grade Core Network Services The infoblox appliance-based platform integrates distributes, and manages DNS, DHCP, IPAM, TFTP, NTP and more to drive networks and applications Executive Summary Networks and applications have become highly dependent on a collection of essential core network services that are not always “visible” or on the forefront of IT project lists. For example, virtually all applications, including web, e-mail, ERP, CRM, and Microsoft’s Active Directory require the Domain Name System (DNS) for their basic operation. Most IP-based devices, including laptops and desktops, require Dynamic Host Configuration Protocol (DHCP) to obtain an IP address. Newer devices such as IP phones, RFID readers, and cameras that are network-connected require file transfer services (via TFTP or HTTP) to receive configuration information and firmware updates. If core network services are compromised, networks and applications fail. These failures often manifest themselves as “network” or “application” issues but are often caused by failure of the underlying core network services themselves. A majority of enterprises still use an “ad-hoc” collection of disparate systems to deploy core network services and are, therefore, experiencing growing problems with availability, security, audit-ability, and real-time data integration that threaten current and future applications. For more than a decade, the focus of networking professionals has been on physical network architectures with high levels of redundancy and fault-tolerance. From the endpoint inward, enterprise networks are designed to provide high availability with device redundancy and multiple paths among users and data. One of the key components of these architectures has been the network appliance, purpose-built devices that are designed to perform a specific function such as routing, switching, or gateway applications. -
7750 SR OS System Management Guide
7750 SR OS System Management Guide Software Version: 7750 SR OS 10.0 R4 July 2012 Document Part Number: 93-0071-09-02 *93-0071-09-02* This document is protected by copyright. Except as specifically permitted herein, no portion of the provided information can be reproduced in any form, or by any means, without prior written permission from Alcatel-Lucent. Alcatel, Lucent, Alcatel-Lucent and the Alcatel-Lucent logo are trademarks of Alcatel-Lucent. All other trademarks are the property of their respective owners. The information presented is subject to change without notice. Alcatel-Lucent assumes no responsibility for inaccuracies contained herein. Copyright 2012 Alcatel-Lucent Alcatel-Lucent. All rights reserved. Table of Contents Preface. .13 Getting Started Alcatel-Lucent 7750 SR Router Configuration Process . .17 Security Authentication, Authorization, and Accounting . .20 Authentication . .21 Local Authentication . .22 RADIUS Authentication . .22 TACACS+ Authentication . .25 Authorization . .26 Local Authorization. .27 RADIUS Authorization . .27 TACACS+ Authorization. .27 Accounting. .28 RADIUS Accounting . .28 TACACS+ Accounting . .28 Security Controls . .30 When a Server Does Not Respond . .30 Access Request Flow . .31 CPU Protection . .32 CPU Protection Extensions ETH-CFM . .36 Vendor-Specific Attributes (VSAs) . .38 Other Security Features . .39 Secure Shell (SSH) . .39 Per Peer CPM Queuing. .41 Filters and Traffic Management. .42 TTL Security for BGP and LDP . .43 Exponential Login Backoff . .43 User Lockout . .45 Encryption . .46 802.1x Network Access Control . .46 TCP Enhanced Authentication Option. .46 Packet Formats . .48 Keychain. .49 Configuration Notes . .50 General . .50 Configuring Security with CLI . .51 Setting Up Security Attributes. .52 Configuring Authentication . .52 Configuring Authorization . -
Diameter Configuration, Maintenance, and DSR Applications Guide 910-6573-001 Revision B December 2012
EAGLE® XG Diameter Signaling Router Diameter Configuration, Maintenance, and DSR Applications Guide 910-6573-001 Revision B December 2012 Copyright 2012 Tekelec. All Rights Reserved. Printed in USA. Legal Information can be accessed from the Main Menu of the optical disc or on the Tekelec Customer Support web site in the Legal Information folder of the Product Support tab. Table of Contents Chapter 1: Introduction.....................................................................12 Purpose of this document......................................................................................................13 Scope and Audience...............................................................................................................13 Manual Organization..............................................................................................................13 Documentation Admonishments..........................................................................................14 Customer Care Center............................................................................................................14 Emergency Response..............................................................................................................16 Locate Product Documentation on the Customer Support Site.......................................17 Chapter 2: Diameter Signaling Router (DSR)...............................18 Diameter Signaling Router Overview..................................................................................19 DSR -
Security Analysis for MQTT in Internet of Things
DEGREE PROJECT IN COMPUTER SCIENCE AND ENGINEERING, SECOND CYCLE, 30 CREDITS STOCKHOLM, SWEDEN 2018 Security analysis for MQTT in Internet of Things DIEGO SALAS UGALDE KTH ROYAL INSTITUTE OF TECHNOLOGY SCHOOL OF ELECTRICAL ENGINEERING AND COMPUTER SCIENCE Security analysis for MQTT in Internet of Things DIEGO SALAS UGALDE Master in Network Services and Systems Date: November 22, 2018 Supervisor: Johan Gustafsson (Zyax AB) Examiner: Panos Papadimitratos (KTH) Swedish title: Säkerhet analys för MQTT i IoT School of Electrical Engineering and Computer Science iii Abstract Internet of Things, i.e. IoT, has become a very trending topic in re- search and has been investigated in recent years. There can be several different scenarios and implementations where IoT is involved. Each of them has its requirements. In these type IoT networks new com- munication protocols which are meant to be lightweight are included such as MQTT. In this thesis there are two key aspects which are under study: secu- rity and achieving a lightweight communication. We want to propose a secure and lightweight solution in an IoT scenario using MQTT as the communication protocol. We perform different experiments with different implementations over MQTT which we evaluate, compare and analyze. The results obtained help to answer our research questions and show that the proposed solution fulfills the goals we proposed in the beginning of this work. iv Sammanfattning "Internet of Things", dvs IoT, har blivit ett mycket trenderande ämne inom forskning och har undersökts de senaste åren. Det kan finnas flera olika scenarier och implementeringar där IoT är involverad. Var och en av dem har sina krav. -
Test-Beds and Guidelines for Securing Iot Products and for Secure Set-Up Production Environments
IoT4CPS – Trustworthy IoT for CPS FFG - ICT of the Future Project No. 863129 Deliverable D7.4 Test-beds and guidelines for securing IoT products and for secure set-up production environments The IoT4CPS Consortium: AIT – Austrian Institute of Technology GmbH AVL – AVL List GmbH DUK – Donau-Universit t Krems I!AT – In"neon Technologies Austria AG #KU – JK Universit t Lin$ / Institute for &ervasive 'om(uting #) – Joanneum )esearch !orschungsgesellschaft mbH *+KIA – No,ia -olutions an. Net/or,s 0sterreich GmbH *1& – *1& -emicon.uctors Austria GmbH -2A – -2A )esearch GmbH -)!G – -al$burg )esearch !orschungsgesellschaft -''H – -oft/are 'om(etence 'enter Hagenberg GmbH -AG0 – -iemens AG 0sterreich TTTech – TTTech 'om(utertechni, AG IAIK – TU Gra$ / Institute for A((lie. Information &rocessing an. 'ommunications ITI – TU Gra$ / Institute for Technical Informatics TU3 – TU 3ien / Institute of 'om(uter 4ngineering 1*4T – 1-Net -ervices GmbH © Copyright 2020, the Members of the IoT4CPS Consortium !or more information on this .ocument or the IoT5'&- (ro6ect, (lease contact8 9ario Drobics7 AIT Austrian Institute of Technology7 mario:.robics@ait:ac:at IoT4C&- – <=>?@A Test-be.s an. guidelines for securing IoT (ro.ucts an. for secure set-up (ro.uction environments Dissemination level8 &U2LI' Document Control Title8 Test-be.s an. gui.elines for securing IoT (ro.ucts an. for secure set-u( (ro.uction environments Ty(e8 &ublic 4.itorBsC8 Katharina Kloiber 4-mail8 ,,;D-net:at AuthorBsC8 Katharina Kloiber, Ni,olaus DEr,, -ilvio -tern )evie/erBsC8 -te(hanie von )E.en, Violeta Dam6anovic, Leo Ha((-2otler Doc ID8 DF:5 Amendment History Version Date Author Description/Comments VG:? ?>:G?:@G@G -ilvio -tern Technology Analysis VG:@ ?G:G>:@G@G -ilvio -tern &ossible )esearch !iel.s for the -2I--ystem VG:> >?:G<:@G@G Katharina Kloiber Initial version (re(are. -
An Iot-Based Mobile System for Safety Monitoring of Lone Workers
IoT Article An IoT-Based Mobile System for Safety Monitoring of Lone Workers Pietro Battistoni * , Monica Sebillo and Giuliana Vitiello LabGis Laboratory, Computer Science Department, University of Salerno, 84084 Fisciano, Italy; [email protected] (M.S.); [email protected] (G.V.) * Correspondence: [email protected] Abstract: The European Agency for Safety and Health at Work considers Smart Personal Protective Equipment as “Intelligent Protection For The Future”. It mainly consists of electronic components that collect data about their use, the workers who wear them, and the working environment. This paper proposes a distributed solution of Smart Personal Protective Equipment for the safety monitoring of Lone Workers by adopting low-cost electronic devices. In addition to the same hazards as anyone else, Lone Workers need additional and specific systems due to the higher risk they run on a work site. To this end, the Edge-Computing paradigm can be adopted to deploy an architecture embedding wearable devices, which alerts safety managers when workers do not wear the prescribed Personal Protective Equipment and supports a fast rescue when a worker seeks help or an accidental fall is automatically detected. The proposed system is a work-in-progress which provides an architecture design to accommodate different requirements, namely the deployment difficulties at temporary and large working sites, the maintenance and connectivity recurring cost issues, the respect for the workers’ privacy, and the simplicity of use for workers and their supervisors. Citation: Battistoni, P.; Sebillo, M.; Keywords: IoT mobile solution; Edge-Computing paradigm; wearable devices; MQTT protocol; safety Vitiello, G. An IoT-Based Mobile monitoring; Smart Personal Protective Equipment; Fog-Computing System for Safety Monitoring of Lone Workers. -
Aerohive Configuration Guide: RADIUS Authentication | 2
Aerohive Configuration Guide RADIUS Authentication Aerohive Configuration Guide: RADIUS Authentication | 2 Copyright © 2012 Aerohive Networks, Inc. All rights reserved Aerohive Networks, Inc. 330 Gibraltar Drive Sunnyvale, CA 94089 P/N 330068-03, Rev. A To learn more about Aerohive products visit www.aerohive.com/techdocs Aerohive Networks, Inc. Aerohive Configuration Guide: RADIUS Authentication | 3 Contents Contents ...................................................................................................................................................................................................................... 3 IEEE 802.1X Primer................................................................................................................................................................................................... 4 Example 1: Single Site Authentication .................................................................................................................................................................... 6 Step 1: Configuring the Network Policy ..............................................................................................................................................................7 Step 2: Configuring the Interface and User Access .........................................................................................................................................7 Step 3: Uploading the Configuration and Certificates .................................................................................................................................... -
Mqtt-V5.0-Cs02.Pdf
MQTT Version 5.0 Committee Specification 02 15 May 2018 Specification URIs This version: http://docs.oasis-open.org/mqtt/mqtt/v5.0/cs02/mqtt-v5.0-cs02.docx (Authoritative) http://docs.oasis-open.org/mqtt/mqtt/v5.0/cs02/mqtt-v5.0-cs02.html http://docs.oasis-open.org/mqtt/mqtt/v5.0/cs02/mqtt-v5.0-cs02.pdf Previous version: http://docs.oasis-open.org/mqtt/mqtt/v5.0/cs01/mqtt-v5.0-cs01.docx (Authoritative) http://docs.oasis-open.org/mqtt/mqtt/v5.0/cs01/mqtt-v5.0-cs01.html http://docs.oasis-open.org/mqtt/mqtt/v5.0/cs01/mqtt-v5.0-cs01.pdf Latest version: http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.docx (Authoritative) http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.pdf Technical Committee: OASIS Message Queuing Telemetry Transport (MQTT) TC Chairs: Brian Raymor ([email protected]), Microsoft Richard Coppen ([email protected]), IBM Editors: Andrew Banks ([email protected]), IBM Ed Briggs ([email protected]), Microsoft Ken Borgendale ([email protected]), IBM Rahul Gupta ([email protected]), IBM Related work: This specification replaces or supersedes: • MQTT Version 3.1.1. Edited by Andrew Banks and Rahul Gupta. 29 October 2014. OASIS Standard. http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/os/mqtt-v3.1.1-os.html. This specification is related to: • MQTT and the NIST Cybersecurity Framework Version 1.0. Edited by Geoff Brown and Louis-Philippe Lamoureux. -
Synergy MQTT/TLS AWS Cloud Connectivity Solution
Application Note Renesas Synergy™ Platform Synergy MQTT/TLS AWS Cloud Connectivity Solution Introduction This application note describes IoT Cloud connectivity solution in general, introduces you briefly to IoT Cloud providers, like Amazon Web Services (AWS), and covers the Synergy MQTT/TLS module, its features, and operational flow sequence (Initialization/Data flow). The application example provided in the package uses AWS IoT Core. The detailed steps in this document show first-time AWS IoT Core users how to configure the AWS IoT Core platform to run this application example demonstration. This application note enables you to effectively use the Synergy MQTT/TLS modules in your own design. Upon completion of this guide, you will be able to add the MQTT/TLS module to your own design, configure it correctly for the target application, and write code using the included application example code as a reference and efficient starting point. References to detailed API descriptions, and other application projects that demonstrate more advanced uses of the module, are in the Synergy Software Package (SSP) User’s Manual, which serves as a valuable resource in creating more complex designs. This Synergy MQTT/TLS AWS Cloud Connectivity solution is supported on AE-CLOUD1 and AE-CLOUD2 kits. Required Resources To build and run the MQTT/TLS application example, you need: Development tools and software • e2 studio ISDE v7.5.1 or later, or IAR Embedded Workbench® for Renesas Synergy™ v8.23.3 or later, available at www.renesas.com/synergy/tools . • Synergy Software Package (SSP) 1.7.8 or later (www.renesas.com/synergy/ssp) • Synergy Standalone Configurator (SSC) 7_3_0 or later (www.renesas.com/synergy/ssc) • SEGGER J-link® USB driver (www.renesas.com/synergy/jlinksynergy) Hardware • Renesas Synergy™ AE-CLOUD1 kit (www.renesas.com/synergy/ae-cloud1), which includes Wi-Fi board; and, AE-CLOUD2 kit (www.renesas.com/synergy/ae-cloud2), which includes a Pillar board, Wi-Fi board and BG96 Cellular shield. -
A Comparison of Iot Application Layer Protocols Through a Smart Parking Implementation
A Comparison of IoT application layer protocols through a smart parking implementation Paridhika Kayal and Harry Perros {pkayal,hp}@ncsu.edu Computer Science Department North Carolina State University Abstract—Several IoT protocols have been introduced in order to high performance, real-time data sharing or real-time device provide an efficient communication for resource-constrained control. In many cases data is collected for subsequent applications. However, their performance is not as yet well “offline” processing. The WebSocket (WS) standard provides understood. To address this issue, we evaluated and compared bi-directional Web communication and connection four communication protocols, namely, CoAP, MQTT, XMPP, management. WebSocket is a good IoT solution if the devices and WebSocket. For this, we implemented a smart parking application using open source software for these protocols and can afford the WebSocket payload. Other protocols, such as, measured their response time by varying the traffic load. SMQ and CoSIP are also gaining traction. All these protocols Keywords—CoAP, MQTT, XMPP, WebSocket, smart parking, are positioned as real-time publish-subscribe IoT protocols, response time. with support for millions of devices. Depending on how you define “real time” (seconds, milliseconds or microseconds) I. INTRODUCTION and “things” (WSN node, multimedia device, personal An IoT application typically involves a large number of wearable device, medical scanner, engine control, etc.), the deployed and interconnected sensors and gateways. The protocol selection for an application is critical. sensors measure the physical environment and send the data to II. RELATED WORK a gateway. The gateway aggregates the data from various sensors and then sends it to a server/broker. -
Diameter-Based Protocol in the IP Multimedia Subsystem
International Journal of Soft Computing and Engineering (IJSCE) ISSN: 2231 – 2307, Volume- 1 Issue- 6, January 2012 Diameter-Based Protocol in the IP Multimedia Subsystem Vinay Kumar.S.B, Manjula N Harihar Abstract— The Diameter protocol was initially developed by II. ROLE OF DIAMETER IN IMS the Internet Engineering Task Force (IETF) as an Authentication, Authorization, and Accounting (AAA) framework The IMS is based on a horizontally layered architecture, intended for applications such as remote network access and IP consisting of three layers, namely, Service Layer, Control mobility. Diameter was further embraced by the Third Generation Layer, and Connectivity Layer. Service Layer comprises Partnership Project (3GPP) as the key protocol for AAA and application and content servers to execute value-added mobility management in 3G networks. The paper discusses the use services for the user. Control layer comprises network control of Diameter in the scope of the IP Multimedia Subsystem (IMS) as servers for managing call or session set-up, modification and specified by 3GPP. This paper presents a solution for the problem release. The most important of these is the Call Session of how to provide authentication, authorization and accounting Control Function (CSCF). Connectivity Layer comprises of (AAA) for multi-domain interacting services by referring open routers and switches, for both the backbone and the access diameter. We have studied the case of ‘FoneFreez’, a service that provides interaction between different basic services, like network telephony and television. The involvement of several parties like A. IMS functions television provider, telephony provider etc., secure interaction between multiple domains must be assured.