Chapter 2
14
2.8 Security
The ADSL devices include security features such as Password Protection, User
Authentication, Password Authentication and Protocol/Challenge Handshake
Authentication Protocol (PAP/CHAP) to prevent unauthorized or inadvertent
access to the router through the Internet.
PAP/CHAP must be enabled by both ends of the link. The following sequence
describes how authentication occurs:
PAP verifies passwords between the ADSL devices using a two-way
handshake. A device (known as the Peer) sends the system name and
password to a destination device (or other PPP servers). The
destination ADSL device (known as the Authenticator) checks the
password against the configured password and returns either an
‘accept’ or a ‘reject’ reply.
CHAP provides additional security with a three-way handshake. The
‘Authenticator’
challenges
the
originating
ADSL
device
by
generating a random number and sending it along with the system
name. The ‘Peer’ then applies a one-way encryption algorithm to the
random number and returns this encrypted information along with the
system name. The Authenticator then runs the same algorithm and
compares the result with the expected value. This authentication
method depends upon a password known only to both ends.
The ADSL devices support Virtual Private Networks (VPNs) with PPTP and
L2TP.
