You work as a Network Administrator for Tech Perfect Inc. The company has a Windows Active Directory-based single domain single forest network. The…

The company's security policy mandates the use of smart cards for authentication. Smart cards function by securely storing a user's digital certificate and private key. The IEEE 802.1X standard provides a framework for port-based network access control. Within this framework, the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) method is specifically designed for strong, certificate-based mutual authentication. The client (laptop) presents its certificate, stored on the smart card, to the authentication server (e.g., a RADIUS server), and the server presents its certificate to the client. This process directly fulfills the requirement for smart card authentication.

B. IEEE 802.1X using PEAP-MS-CHAP: This method authenticates the client using username and password credentials (MS-CHAPv2) inside a TLS tunnel, not with client-side certificates from a smart card.

C. Pre-shared key: This method uses a single, shared password for all devices on the network and does not support individual user authentication, let alone smart card integration.

D. Open system: This method involves no authentication whatsoever, allowing any device within range to connect, which is in direct violation of the security policy.

1. Microsoft Corporation. (2003). EAP-TLS. Windows Server 2003 Technical Library. Microsoft TechNet. Retrieved from https://technet.microsoft.com/en-us/library/cc755983(v=ws.10).aspx. The document states

"EAP-TLS is one of the strongest EAP authentication methods. It uses a client certificate to authenticate the user or computer to the server... EAP-TLS is the required EAP type for smart card-based logon."

2. Massachusetts Institute of Technology (MIT) Information Systems and Technology. (n.d.). 802.1X Authentication for Wireless Connections. MIT Knowledge Base. In the section "EAP Types

" it is specified that "EAP-TLS (EAP-Transport Layer Security) requires both the client and the server to have certificates to trust each other." This confirms that EAP-TLS is the certificate-based method suitable for smart cards.

3. Djenouri

D.

& Khelladi

L. (2005). Analysis of EAP Methods for Wireless Network Security. IEEE Communications Surveys & Tutorials

7(4)

2-11. https://doi.org/10.1109/COMST.2005.1593275. In Section III-A

"EAP-TLS

" the paper describes this method as providing mutual authentication based on X.509 certificates for both the client and the authentication server

which is the mechanism used by smart cards for network access.