HP-UX AAA Server A.08.01 administrator's guide (T1428-90072, May 2010)

the result parameter (RES) generated using the RAND and the pres-hared secret
key. It also includes a message authentication code for integrity protection.
7. The AAA Server on receiving the EAP Response message compares the result
parameter with XRES parameter in corresponding authentication vector. On
successfully comparison and validating the message authentication code, the AAA
Server sends an EAP Success message encapsulated inside Access-Accept message
to the Access point with the session key.
8. The Access point forwards the EAP Success message to the supplicant, and keeps
the keying material for encrypting the user’s session. The supplicant also has
derived the same encryption key so the Access point does not forward to the
supplicant.
9. With the common session key, the network traffic between the access point and
the supplicant can now be encrypted and the supplicant can securely access the
network.
The EAP-AKA uses an example algorithm for key generation that can be customized
or replaced with operator specific key generation algorithm.
EAP-AKA includes optional identity privacy support, wherein the supplicant can send
a temporary (pseudonym) identity instead of using the clear text permanent identity
to prevent eavesdroppers. In such cases the HP-UX AAA Server has to do a lookup of
the Real user name i.e the permanent identity on receiving the pseudonym identity.
The mapping of the permanent identity with the pseudonym and vice versa can be
done using algorithms built inside the Server or using an external storage like SQL
compliant database with the mapping information.
EAP-AKA also includes optional fast re-authentication support, wherein the previously
generated Master Session Key during full authentication process will be used to generate
a fresh Master Session Key. A supplicant requesting the fast re-authentication will send
the fast re-authentication identity got during previous full authentication. The HP-UX
AAA Server internally maps the fast re-authentication identity to the permanent identity
either using an optional internal cache or using an external storage like SQL compliant
database with the mapping information.
NOTE: The HP-UX AAA Server can also generate the AV.
Features
The EAP-AKA authentication method is fully compliant with RFC 4187. It supports
the following features:
• IMSI permanent identities are supported on a per realm basis.
• Non-IMSI permanent identities are supported on a per realm basis.
• Protected success indications are supported on a per realm basis.
• Fast re-authentication is supported on a per realm basis.
EAP-AKA 237