WLAN Security
64
SWRU455A – February 2017 – Revised March 2017
Copyright © 2017, Texas Instruments Incorporated
WLAN
–
Private Key – Station (client) RSA private key file in PEM format
–
Client Certificate – Certificate of the client, given by the authenticating network (has the public key
matches to the private key) in PEM format
•
Server Authentication
The SimpleLink Wi-Fi device requires server authentication by default and the following file is required:
Server Root CA file – This file must be in PEM format. The demand for server authentication can
be canceled through the WLAN setting. Canceling this authentication is valid for a single manual
connection only.
Example:
_i16 Status;
_u8 param;
_u8 param = 1;
/* 1 means disable the server authentication */
Status
=
sl_WlanSet(SL_WLAN_CFG_GENERAL_PARAM_ID,SL_WLAN_GENERAL_PARAM_DISABLE_ENT_SERVER_AUTH,1,¶m);
if
( Status )
{
/* error */
}
Those files must be programmed with the following names:
•
Root CA – sys/cert/ca.der
•
Client certificate – sys/cert/client.der
•
Private key – sys/cert/private.key
Manual enterprise connection and preferred network enterprise connection both include the same security
information needed to complete enterprise connection.
The following information is required according to the server demands:
•
User – Enterprise identity name. Maximum length is 64 bytes.
•
Anonymous user – Anonymous EAP identity. Maximum length is 64 bytes.
•
EAP method – defines the EAP methods.
Configure to one of the following values according to the target authentication method:
•
SL_WLAN_ENT_EAP_METHOD_TLS
•
SL_WLAN_ENT_EAP_METHOD_TTLS_TLS
•
SL_WLAN_ENT_EAP_METHOD_TTLS_MSCHAPv2
•
SL_WLAN_ENT_EAP_METHOD_TTLS_PSK
•
SL_WLAN_ENT_EAP_METHOD_PEAP0_TLS
•
SL_WLAN_ENT_EAP_METHOD_PEAP0_MSCHAPv2
•
SL_WLAN_ENT_EAP_METHOD_PEAP0_PSK
•
SL_WLAN_ENT_EAP_METHOD_PEAP1_TLS
•
SL_WLAN_ENT_EAP_METHOD_PEAP1_PSK
•
SL_WLAN_ENT_EAP_METHOD_FAST_AUTH_PROVISIONING
•
SL_WLAN_ENT_EAP_METHOD_FAST_UNAUTH_PROVISIONING
•
SL_WLAN_ENT_EAP_METHOD_FAST_NO_PROVISIONING
The SimpleLink Wi-Fi supports only one enterprise profile and requires using the above-specified file
names.
An example of manual connection to an enterprise network:
SlWlanSecParams_t SecParams;
SlWlanSecParamsExt_t
SecExtParams;
_i16 Status;
SecParams.Type = SL_WLAN_SEC_TYPE_WPA_ENT;