Network access control for trusted platforms
In response to a request received at an authentication server from a client to enter a network, the authentication server transmits a network access control (NAC) request to the client using a NAC protocol. The NAC request includes an identifier (ID) identifying a trusted platform (TP) credential that represents integrity of at least a portion of software and hardware configurations of the client. In response to a NAC response from the client, the authentication server compares the first TP credential with a second TP credential stored in a storage associated with the authentication server. The authentication server allows the client to enter the network if the first and second TP credentials are matched; otherwise, the client is prevented from entering the network.
1. A method comprising:
in response to a request received at an authentication server comprising a processor from a client entering a network, transmitting by the authentication server a network access control (NAC) request to the client using a NAC protocol, wherein the NAC request is compatible with a first extensible authentication protocol (EAP) method, the NAC request comprising an identifier (ID) identifying a trusted platform (TP) credential that represents integrity of at least a portion of software and hardware configurations of the client, wherein the client represents a host operating system (OS) hosting a guest OS representing a virtual machine comprising a virtual trusted platform module (VTPM), the VTPM spawned from a base trusted platform module, and wherein a network connection is provided to the guest OS virtually via a software bridge implemented in a kernel of the host OS;
receiving, at the authentication server, a NAC response from the client, the NAC response comprising a first TP credential embedded therein and a different EAP method;
in response to the NAC response, the processor of the authentication server comparing the first TP credential with a second TP credential stored in a storage associated with the authentication server;
allowing, by the authentication server, the client to enter the network when the first and second TP credentials are matched using the different EAP method; and
denying, by the authentication server, the request of the client to enter the network when the first TP credential does not match the second TP credential using the different EAP method.
2. The method of claim 1 , wherein the TP credential is retrieved from a trusted platform module (TPM) of the client, and wherein the TPM module is implemented in at least one of software or hardware compatible with a TPM specification set forth by a trusted computing group (TCG) standard body.
3. The method of claim 2 , wherein the TP credential comprises at least one of endorsement credential, conformance credential, platform credential, validation credential, or identity credential specified in the TPM specification.
4. The method of claim 1 , wherein the NAC protocol is compatible with an Institute of Electrical and Electronics Engineers (IEEE) 802.1X protocol.
5. The method of claim 4 , wherein the NAC request message is compatible with an Extensible Authentication Protocol (EAP) method REQUEST message, and wherein the ID of the requested TP credential is specified within the EAP method REQUEST message.
6. The method of claim 5 , wherein the NAC response message is compatible with an EAP method RESPONSE message, and wherein the first TP credential is embedded within the EAP method RESPONSE message.
7. The method of claim 1 , wherein the TP credential represents integrity of at least a portion of the host OS and software hosted by the host OS.
8. The method of claim 1 , wherein the TP credential represents integrity of at least a portion of the guest OS and software hosted by the guest OS.
9. A non-transitory computer-readable storage medium having instructions stored therein, which when executed by a processor, cause the processor to execute operations comprising:
in response to a request received at an authentication server comprising the processor from a client entering a network, transmitting by the authentication server a network access control (NAC) request to the client using a NAC protocol, wherein the NAC request is compatible with a first extensible authentication protocol (EAP) method, the NAC request comprising an identifier (ID) identifying a trusted platform (TP) credential that represents integrity of at least a portion of software and hardware configurations of the client, wherein the client represents a host operating system (OS) hosting a guest OS representing a virtual machine comprising a virtual trusted platform module (VTPM), the VTPM spawned from a base trusted platform module, and wherein a network connection is provided to the guest OS virtually via a software bridge implemented in a kernel of the host OS;
receiving, at the authentication server, a NAC response from the client, the NAC response comprising a first TP credential embedded therein and a different EAP method;
in response to the NAC response, the processor of the authentication server comparing the first TP credential with a second TP credential stored in a storage associated with the authentication server;
allowing, by the authentication server, the client entering the network when the first and second TP credentials are matched using the different EAP method; and
denying, by the authentication server, the client entering the network when the first TP credential does not match the second TP credential using the different EAP method.
10. The non-transitory computer-readable storage medium of claim 9 , wherein the TP credential is retrieved from a trusted platform module (TPM) of the client, and wherein the TPM module is implemented in at least one of software or hardware compatible with a TPM specification set forth by a trusted computing group (TCG) standard body.
11. The non-transitory computer-readable storage medium of claim 10 , wherein the TP credential comprises at least one of endorsement credential, conformance credential, platform credential, validation credential, or identity credential specified in the TPM specification.
12. The non-transitory computer-readable storage medium of claim 9 , wherein the NAC protocol is compatible with an Institute of Electrical and Electronics Engineers (IEEE) 802.1X protocol.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the NAC request message is compatible with an Extensible Authentication Protocol (EAP) method REQUEST message, and wherein the ID of the requested TP credential is specified within the EAP method REQUEST message.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the NAC response message is compatible with an EAP method RESPONSE message, and wherein the first TP credential is embedded within the EAP method RESPONSE message.
15. The non-transitory computer-readable storage medium of claim 9 , wherein the TP credential represents integrity of at least a portion of the host OS and software hosted by the host OS.
16. The non-transitory computer-readable storage medium of claim 9 , wherein the TP credential represents integrity of at least a portion of the guest OS and software hosted by the guest OS.
17. A method comprising:
receiving, by a processor of a client, a network access control (NAC) request from an authentication server using a NAC protocol for authenticating the client, the NAC request comprising an identifier (ID) identifying a trusted platform (TP) credential that represents integrity of at least a portion of software and hardware configurations of the client, wherein the NAC request is compatible with a first extensible authentication protocol (EAP) method, wherein the client represents a host operating system (OS) hosting a guest OS representing a virtual machine comprising a virtual trusted platform module (VTPM), the VTPM spawned from a base trusted platform module, and wherein a network connection is provided to the guest OS virtually via a software bridge implemented in a kernel of the host OS;
in response to the NAC request, retrieving a first TP credential from a TPM module of the client in view of the ID extracted from the NAC request;
transmitting a NAC response to the authentication server, the NAC response comprising the first TP credential embedded therein and a different EAP method; and
receiving a result from the authentication server indicating whether the client has been successfully authenticated, wherein the first TP credential is used by the authentication server to compare against a second TP credential stored in a storage associated with the authentication server to determine whether the client is entitled to enter the network using the different EAP method.
18. The method of claim 17 , wherein the TPM module is compatible with a TPM specification set forth by a trusted computing group (TCG) standard body, and wherein the TP credential comprises at least one of endorsement credential, conformance credential, platform credential, validation credential, or identity credential specified in the TPM specification.
19. The method of claim 17 , wherein the NAC protocol is compatible with an Institute of Electrical and Electronics Engineers (IEEE) 802.1X protocol, wherein the NAC request message is compatible with an Extensible Authentication Protocol (EAP) method REQUEST message, wherein the ID of the requested TP credential is specified within the EAP method REQUEST message, wherein the NAC response message is compatible with an EAP method RESPONSE message, and wherein the first TP credential is embedded within the EAP method RESPONSE message.
20. The method of claim 17 , wherein the TP credential represents integrity of at least a portion of the host OS and software hosted by the host OS.
21. The method of claim 17 , wherein the TP credential represents integrity of at least a portion of the guest OS and software hosted by the guest OS.