802[1].1x technology white paper

IEEE 802.1x模块指南IEEE 802.1X模块使用指南目录1. 前言 (3)1.1 关于本文档 (3)1.2 背景知识 (3)1.2.1 802.1X技术的介绍 (3)1.2.2 802.1X的认证原理 (3)1.2.3 802.1X的认证流程 (4)1.3 术语 (5)2. IEEE 802.1X模块介绍 (5)2. 1 客户端功能 (6)2. 2认证者的功能 (6)2.3认证服务器的功能 (6)2.4 802.1x模块的软件实现-开源组件hostapd (6)3. 关于hostapd开源组件 (7)3.1 hostapd开源组件介绍 (7)4. hostapd的帮助程序使用 (9)4.1 关于帮助程序 (9)4.2 命令参数实现及说明 (9)4.3 usage程序使用实例 (10)IEEE 802.1x模块指南HistoryDate Version Changes2011-11-30Draft A完成第一稿IEEE 802.1x模块指南1. 前言1.1 关于本文档本文档对dot1x模块的的基本情况、编译方法、配置参数、基本工作原理作了详细的阐述，可以使开发人员依据该文档可较好的掌握模块的使用，为开发人员节约时间。

1.2 背景知识802.1X是IEEE为了解决基于端口的接入控制而定义的标准，被称为基于端口的访问控制协议(Port based network aceess control protocol)。

为运营商建设可运营、可管理的电信级宽带以太网提供了良好的支持。

1.2.1 802.1X技术的介绍IEEE 802.1x 协议的体系结构包括3个重要的组成部分：客户端、认证系统、认证服务器，图1.1描述了三者之间的关系以及相互之间的通信。

图1.1 802.1X认证体系1.2.2 802.1X的认证原理客户端系统通常需要安装一个客户端软件，用户通过启动这个客户端软件发起802.1x 协议的认证过程，为了支持基于端口的接入控制，客户端系统需支持EAPOL(extensibleauthentication protocol overLAN)协议。

80211a c白皮书1.概述1.1技术背景在802.11n标准制定后不久，为了获取更高的传输速率，IEEE转入了802.11ac标准的制定当中，目标是在2012年实现千兆级别的无线局域网传输速率，而802.11ac实际上是在802.11a基础上发展起来的。

从2008年上半年开始，IEEE就已经着手802.11ac标准的制定，当时被称为“Very High Throughput”(甚高吞吐量)，目标直接就是达到1Gbps。

到2008年下半年的时候，项目分为两部分，一是802.11ac，工作在6GHz 以下，用于中短距离无线通信，正式定为802.11n的继任者，另一个则是802.11ad，工作在60GHz，市场定位与UWB类似，主要面向家庭娱乐设备。

而到了2012年2月，制定了我们现在看到的D2.0版本。

1.2技术特点802.11ac有如下几个特点：更高的传输速率：802.11ac最高可以支持约7000Mb/s传输速率，这主要得益于OFDM技术以及更高的占用带宽，而MU-MIMO技术提升带宽利用率。

更好的环境适应性：延续使用MIMO技术，增加了空间流的数量。

更好的保证了接收性能。

更少的环境干扰：使用5G频段，减少2.4G公共频段的支持，也就减少了其它信号对自身的干扰，获得更为清洁的频谱环境。

2.名词解释MSDU：MAC Service Data Unit。

可以理解为传输的有效数据，MAC帧的data部分。

MPDU：MAC Protocol Data Unit。

可以理解为经过MAC协议封装的帧，包括MAC帧头。

PLCP：Physical Layer Convergence Procedure。

可以理解为PHY层的编码和封包过程。

PPDU：PLCP Protocol Data Unit。

可以理解为PHY层封装的帧，包括PHY 帧头和MAC帧。

A-MSDU：Aggregate MSDU。

MSDU帧聚合。

paper的意思用法总结paper有什么意思呢?paper它的用法是怎样的呢?今日我给大家带来了paper 的用法,希望能够关怀到大家，一起来学习吧。

paper的用法总结大全paper的意思n. 纸,文件,论文,文章vt. vi. 贴纸vt. 包装，用纸覆盖,贴壁纸,提供纸张,[俚语] 提供免费入场券vi. 贴糊墙纸,发交通违章传票adj. 纸制的,似纸的,知名无实的变形：过去式: papered; 如今分词：papering; 过去分词：papered;paper用法paper可以用作名词paper的基本意思是“纸”,通常用作物质名词,不行数。

如表示可数性,则须借助于单位词。

“一小张纸”是a piece of paper; “一大张标准尺寸的纸”是a sheet of paper。

paper作“写过字的纸”解时,是可数名词,有复数形式。

paper也可作“报纸”“文件”“证件”“试卷”“论文”等解,可用复数形式。

paper的基本意思是用纸贴或用纸覆盖,引申可表示“隐瞒,掩饰”。

用作及物动词,后接名词或代词作宾语。

paper用作名词的用法例句That paper has yellowed with age.那张纸因年月久远而泛黄了。

The letter was written on a single sheet of paper.这封信只用一张纸写成。

He refused to subscribe his name to the paper.他拒绝在这文件上签字。

paper可以用作动词paper的基本意思是用纸贴或用纸覆盖,引申可表示“隐瞒,掩饰”。

用作及物动词,后接名词或代词作宾语。

paper用法例句1、He wiped away the blood with a paper napkin.他用纸巾将血迹擦去。

2、Under the newspaper, atop a sheet of paper, lay an envelope.在报纸下面的一张纸上放着一个信封。

Secure Boot for Linux onHPE ServersEnhanced security for your Linux environment ContentsWhat is Secure Boot? (2)Chain of trust (2)HPE Server support for Secure Boot (3)Limitations of Secure Boot (3)Secure Boot on HPE Servers (3)Enabling/Disabling Secure Boot (3)Signing a kernel module and loading the associated key in the MOK (4)Building and Booting a Custom Kernel (6)Resources (8)Secure Boot for high performance computing software, as defined inthe UEFI specification, provides an industry standard defense against potential malware attacks. Without Secure Boot, malware can attacksystems during pre-boot by targeting the system-embedded firmwareduring the interval between BIOS initiation and operating systemload. Malware inserted at this point compromises the security of the operating system, no matter how secure. Secure Boot protects thesystem by preventing the insertion of malware during the pre-boot process.This technical white paper introduces Secure Boot technology andexplains what it is, how it works and how to use it on UEFI basedHPE servers running Linux®.What is Secure Boot?Secure Boot, a high performance computing software solution, is a method to restrict which binaries can be executed to boot the system.With Secure Boot, the system BIOS will only allow the execution of boot loaders that carry the cryptographic signature of trusted entities.In other words, anything run in the BIOS must be “signed” with a key that the system knows is trustworthy. With each reboot of the server, every executed component is verified. This prevents malware from hiding embedded code in the boot chain.Secure Boot is:•Intended to prevent boot-sector malware or kernel code injection.•Hardware-based code signing.•Extension of the UEFI BIOS architecture.•Optional with the ability to enable or disable it through the BIOS.For a more detailed description of what Secure Boot is and how it works, see the Resources section.Chain of trustSLES11 SP3, RHEL 7.0 and greater distributions support a chain of trust which goes down to the kernel module level. Loadable kernel modules must be signed with a trusted key or they cannot be loaded into the kernel.The following trusted keys are stored in UEFI NVRAM variables:•Database (DB)—Signature database that contains well know keys. Only binaries that can be verified against the DB are executed by the BIOS. •Forbidden Signature Database (DBX)—Keys that are blacklisted. Attempting to load an object with a key that matches an entry in the DBX will be denied.•Machine Owner Key (MOK)—User added keys for kernel modules they want to install.•Platform Key (PK)—The key installed by the hardware vendor.•Key Exchange Key (KEK)—The key required to update the signature database.The user must have physical access to the system console to add/modify keys or enable/disable Secure Boot through the UEFI configuration menu.The default boot loader on most UEFI enabled servers running Linux is grub2 or elilo. With Secure Boot enabled, an additional “shim” boot loader is needed. When booting in Secure Boot mode, the shim loader is called first since it contains a trusted signature. The shim will then load grub2 or elilo which loads the OS kernel which is also signed.HPE Server support for Secure BootHPE Gen9 servers and greater with UEFI enabled will support Secure Boot. To determine whether Secure Boot is supported on a specific platform and enabled or disabled by default, please check the system specifications.Some Linux distributions extend the chain of trust to the kernel module. Consult the distribution’s documentation for what level of Secure Boot support is provided.Limitations of Secure BootWith Secure Boot enabled, some actions on a Linux system are either limited or restricted.•Hybrid ISO images are not recognized as bootable on UEFI systems. Thus, UEFI booting from USB devices is not supported.•Boot loader, kernel, and kernel modules must be signed.•kexec and kdump are disabled.•Hibernation (suspend on disk) is disabled.•Write access to /dev/kmem and /dev/mem is not possible, not even as root user.•Access to I/O port is not possible, even as root user. All X11 graphical drivers must use a kernel driver.•PCI BAR access through sysfs is not possible.•custom_method in ACPI is not available.•acpi_rsdp parameter does not have any effect on the kernel.Secure Boot on HPE ServersTo determine if Secure Boot is enabled, run the following command in Linux:$ od -An -t u1 /sys/firmware/efi/vars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c/dataThe system will return a value of either 0 or 1:•0 = secure boot is NOT enabled• 1 = secure boot is enabledEnabling/Disabling Secure BootTo enable or disable Secure Boot do the following:1.During system boot, press F9 to run the System Utilities.2.Select “System Configuration”.3.Select “BIOS/Platform Configuration (RBSU)”.4.Select “Server Security”.5.Select “Secure Boot Configuration”.6.Select “Enable Secure Boot” to toggle the state on or off (see Figure 1).7.Exit the all RBSU menu screens using the Esc key.For more information, see the HPE UEFI System Utilities User Guide.Figure 1. Enabling Secure Boot through the HPE Server BIOSNote for SLES installationsIf you want to use Secure Boot with SLES, it is advisable to make sure that Secure Boot is enabled prior to installing the operating system. If it is not enabled prior to the installation of SLES, the system may not include all the components needed for Secure Boot. RHEL installations do not have these limitations.Signing a kernel module and loading the associated key in the MOKA Machine Owner Key (MOK) is a type of user generated key that is used to “sign," or authenticate as trustworthy, an Extensible Firmware Interface (EFI) binary. MOK gives you ownership of the boot process by allowing you to run locally-compiled kernels or boot loaders not delivered with the Linux distribution. This means that you can install custom kernel or kernel modules that are compatible with UEFI Secure Boot. For more information, see the Administration Guide for your Linux distribution.To authenticate a kernel module and load the associated key in the MOK, complete the following steps:1.Generate a certificate/key pair with the following command:# openssl req –new –x509 –newkey rsa:2048 –sha256 –keyout key.asc –out cert.der –outformder –nodes –days 4745 –subj “yourname”2.If necessary, sign the kernel module with a private key:# /usr/src/linux/scripts/sign-file sha256 key.asc cert.der e1000e.ko3.Move cert.der to the EFI partition4.To load the public certificate into the MOK, reboot the system, go to the EFI Shell and run the following command::boot/efi/efi/hp # mokutil –import cert.derNoteSome certificates require a password to allow them to be loaded, if so:Input password:Input password again:5.Select “y” and the process is complete with the certificate loaded.Figure 2. Loading a public certificate into the MOKBuilding and Booting a Custom KernelTo boot a custom compiled kernel with Secure Boot enabled, it must be signed with a certificate known to the BIOS. The following SLES11SP3 example illustrates how this is done.1.Enable Secure Boot on the system (see earlier section).2.Go to the kernel source directory:$ cd /usr/src/linux3.Get a copy of the current configuration file:$ RELEASE=`uname -r`$ cp /boot/config-${RELEASE} .config4.Add automatic module signing to the configuration file:Reference: /wiki/Signed_kernel_module_supportEither edit the .config file manually and add the following: CONFIG_MODULE_SIG_ALL=yOr use “make menuconfig” and check the “Automatically sign all modules”:--- Enable loadable module support[*] Forced module loading[*] Module unloading[*] Forced module unloading[*] Module versioning support[*] Source checksum for all modules[*] Module signature support[ ] Check module signatures by default[ ] Require modules to be validly signed[*] Automatically sign all modules[*] Support for blacklisting module signature certificates[*] Allow modules signed with certs stored in UEFI5.Create your own personal key:Reference: /openSUSE:UEFI see “Booting a Custom Kernel”$ cd /usr/src/linuxNoteYou only need to create and register a key once. Multiple kernels can be signed with the same key.6.Create a custom X.509 key and certificate used for signing:$ openssl req -new -x509 -newkey rsa:2048 -sha256 -keyout key.asc -out cert.der -outform der -nodes -days 4745 -subj “/CN=$USER/"7.Package the key and certificate as PKCS#12 structure:$ openssl pkcs12 -export -inkey key.asc -in cert.pem -name kernel_cert -out cert.p128.Generate the NSS database for use by pesign:$ certutil -d . -N9.Import the key and certificate contained in PKCS#12 into the NSS database:$ pk12util -d . -i cert.p1210.To allow unsupported modules to load, edit the /etc/modprobe.d/unsupported-modules file and add “allow_unsupported_modules 1”:$ vi /etc/modprobe.d/unsupported-modules11.It is advisable to modify the “Makefile” and add something to “EXTRAVERSION =” so your new kernel is installed beside the existingkernel instead of overwriting it.$ vi Makefile12.Build the kernel/modules and install them:$ make$ make modules_install$ make install13.Get the version of your new kernel:$ RELEASE=`cd /usr/src/linux ; make kernelrelease` ; echo $RELEASE14.Create initramfs for the new kernel:$ /sbin/mkinitrd -k /boot/vmlinuz-${RELEASE} -i initrd-${RELEASE}15.Setup bootloader configuration file:$ /sbin/update-bootloader --name ${RELEASE} --image /boot/vmlinuz-${RELEASE} --initrd/boot/initrd-${RELEASE} --add --force16.Manually sign the kernel:$ pesign -n . -c kernel_cert -i arch/x86/boot/bzImage -o vmlinuz.signed -s$ mv vmlinuz.signed /boot/vmlinuz-${RELEASE}17.List the signatures for the kernel image:$ pesign -n . -S -i /boot/vmlinuz-${RELEASE}18.Convert the certificate to DER format for import into the UEFI BIOS or MOK:$ openssl x509 -in cert.pem -outform der -out cert.der19.Copy the certificate to the EFI partition so you can import it:$ cp cert.der /boot/efi/cert.derNoteThe SLES “mokutil” utility can also be used to queue up the inclusion of a new key. It will cause “MokManager.efi” to be run automatically.20.Reboot the system to the UEFI shell.Sign up for updates© Copyright 2014, 2017 Hewlett Packard Enterprise Development LP. The information contained herein is subject to changewithout notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.Red Hat is a registered trademark of Red Hat, Inc. in the United States and other countries. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. All other third-party trademark(s) is/are property of their respective owner(s).21. Add the new key to MOK database:a. Run the “MokManager.efi” utility;b. Scroll down to “Enroll key from disk” and hit RETURN;c. Navigate to the “cert.der” file you copied to disk earlier, select it and hit RETURN;d. Follow the directions to enroll the key; ande. Choose “Continue boot” to exit.22. Run “grub.efi” and boot your new kernel as normal.Resources• Using MOK and UEFI Secure Boot with SUSE Linux• UEFI home page where you can find the current UEFI specifications• Blog posts by Olaf Kirch and Vojtěch Pavlík (the chapter above is heavily based on these posts): – /blogs/uefi-secure-boot-plan/– /blogs/uefi-secure-boot-overview/– /blogs/uefi-secure-boot-details/• UEFI with openSUSE• SUSE Linux Enterprise Server 11 SP4 Administrator Guide• UEFI Secure boot with Red Hat®• Fedora UEFI Secure Boot Guide。