![](bg7.png)
encryption_key =
PRF(master_secret,
"client_certificate",
ServerHello.random+ClientHello.random);
Upon receipt of the encrypted client certificate,
the server should decrypt it, and check that the
certificate is valid. Next, the client and the server
continue their exchange as defined in TLS.
Figure 7 illustrates TLS handshake, with our
proposed identity protection mechanism. Identity
protection is negotiated through two TLS extensions
included in client and server Hello messages. The
client’s certificate, which is usually sent in a clear
text, is encrypted according to the negotiated
cryptographic algorithm associated to the
encryption_key, defined above. More details have
been published in an IETF draft (Urien et al.,
2006c).
5.3 Identity Protection with SAM
As we cited before, it’s desirable to manage security
protocols parameters, such as private and secret
keys, by tamper-resistance computers. In this optic,
our SAM smartcard allows highly secure storage of
such credentials and verifies certificates in a trusted
environment. It is, moreover, the only entity in the
chain that retrieves certificates in clear text. In other
words, all TLS cryptographic computations and
certificate encryption/decryption are performed into
the SAM. In this way, the certificate will not flow
unencrypted nor on the network, neither on the client
or server machines.
6 CONCLUSION
Identity protection is a critical requirement for
network’s users, especially in a wireless context. In
this paper, we introduced the SAM concept that
works in WLAN or VPN architectures. Next, we
extended the TLS protocol to provide identity
protection services, and we integrated it within SAM
infrastructures. The use of smart cards allows trusted
computing, ensures client identity protection, and
guaranties safe storage of sensitive credentials.
REFERENCES
RFC 1832, 1995. XDR: External Data Representation
Standard. Internet Engineering Task Force, IETF.
RFC 2131, 1997. Dynamic Host Configuration Protocol,
DHCP. Internet Engineering Task Force, IETF.
RFC 2401, 1998. Security Architecture for the Internet
Protocol. Internet Engineering Task Force, IETF.
IEEE 802.11, 1999. Wireless LAN Medium Access
Control (MAC) and Physical Layer (PHY)
Specifications, Institute of Electrical and Electronics
Engineers.
RFC 2716, 1999. PPP EAP TLS Authentication Protocol.
Internet Engineering Task Force, IETF.
RFC 2246, 1999. The TLS Protocol Version 1.0. Internet
Engineering Task Force, IETF.
Chen, C., 2000, Java Card Technology for Smart Cards.
The Java Series, Addison Wesley, 2000.
Rescorla, E., 2000. SSL and TLS- Designing and Building
Secure Systems, Addison Wesley, 2000.
IEEE 802.1X, 2001. "Local and Metropolitan Area
Networks: Port-Based Network Access Control",
Institute of Electrical and Electronics Engineers.
RFC 3546, 2003. Transport Layer Security (TLS)
Extensions. Internet Engineering Task Force, IETF.
RFC 3559, 2003. Remote Authentication Dial In User
Service Support for EAP. Internet Engineering Task
Force, IETF.
RFC 3748, 2004. Extensible Authentication Protocol,
(EAP). Internet Engineering Task Force, IETF.
Urien P., Badra M., and Dandjinou M., 2004. EAP-TLS
smartcards, from dream to reality. In ASWN 2004,
Fourth workshop on Applications and Services in
Wireless Networks,. Boston, USA.
OpenEapSmartcard, 2005. WEB site,
http://www.enst.fr/~urien/openeapsmartcard.
Urien P., Dandjinou M., 2005. The OpenEapSmartcard
project. Short paper, In ACNS 2005, Applied
Cryptography and Network Security 2005, Columbia
University, New York, USA
ISO 7816, 2006. Identification cards-Integrated circuit(s)
card with contact, International Organization for
Standardization (ISO), ISO/IEC 7816.
JavaCardForum, 2006. www.javacardforum.org
Urien P., Dandjinou M., 2006a. Introducing Smartcard
Enabled RADIUS Server, In CTS 2006, the 2006
International Symposium on Collaborative
Technologies and Systems, Las Vegas, USA.
Urien P., Pujolle, G., 2006b. EAP support in smartcard.
Internet Draft, Internet Engineering Task Force, IETF.
Urien P., Badra M., 2006c. Identity Protection within
EAP-TLS, Internet Draft, Internet Engineering Task
Force, IETF.
SECURE ACCESS MODULES FOR IDENTITY PROTECTION OVER THE EAP-TLS - Smartcard Benefits for User
Anonymity in Wireless Infrastructures
163