Скачать или смотреть Authentication - 7 : Device Authentication

Another type of authentication that helps make networks more secure is device authentication.

The purpose of device authentication is to make sure an authorized device connected to the network is not replaced by an unauthorized device. Imagine the following scenario. An authorized printer is connected to the network; then someone disconnects the printer and attaches a PC to the same port. The person uses this connection to hack into the network and steal passwords or information.

This is a very real problem. With authentication, though, each device is verified. So as soon as the authorized printer is disconnected, and the PC is connected, the device's identity is re-verified. The illegal device is detected, the port is disabled, and the network management software generates an alert about an unauthorized device.

Device authentication is similar to user authentication in that it restricts access to the network, but this time it's based upon the physical device connected to the switch, rather than the user. There are two ways that device authentication works to set up authenticated groups, which are simply the devices that are allowed to access a particular resource.

The first method is device static assignment. The network manager simply assigns switch ports to an authenticated group. The port is always part of the group until the network manager changes its status; that is, it is not required to prove its identity. This type of assignment is generally reserved for network devices that are physically secure.

The second method is device authentication assignment. This type of authentication is based on devices meeting multiple criteria. The criteria can be port, IP address, MAC address, protocol, or a combination of criteria.

In both cases, the network uses authentication to make sure the device it is communicating with is the correct device on the correct port. If it isn't, network access is shut off.