What is the technical term for this wifi configuration?

Question

At my workplace, the method of wifi connection is not like home.

There is a secure network, but there isn't "one" password.

Let me explain what I mean:

Usually when we have WPA security, then there is an SSID, let's assume "internet" and then the password, let's assume "dogs123456".

Then for someone on their mobile, they would select "internet", and enter the password "dogs123456". This is the same for everyone that wants to connect to "internet".

This is not how it works at my company however:

Let's say I worked for company X, and my credentials to login into my computer are [e-mail] and password is john123.

Then to connect to a certain wifi "X-secure", I would enter my "username" as john and password as john123.

Similarly if there is a sarah in my company, she would connect using sarah and password "account password"

This is what I meant by there isn't "one" password.

What is this method of connection called, and can it be impleneted in a home network?

Answer 1

We use keys to authenticate/encrypt data. The difference here is how you get the keys. For better security, there are many keys in Wifi protocol, we use some key to generate/encrypt other keys. The basic key is the pairwise master key (PMK). There are two ways to get this key:

Method 1.

Use a Preshared key (PSK) as the PMK. This is the easier way which is the situation at home. "Preshared" means you defines the key and input the key (strictly you input a password that is easy to read and the router generated the real key based on your password) both into the wireless router's configuration page and client devices like your phone and notebook's Wifi setting UI ----the key is predefined by you and are shared between the router and the clients. The setup is easier, but the key is fixed which is less secure and not easy to manage if there is a lot of clients like in a company, for example if the system manager changes the key, all clients'key need to be updated.

Method 2.

Derive the PMK from a key generated by an Extensible Authentication Protocol (EAP), which is transported whithin the IEEE 802.1X protocol. In this way, the PMK is generated dynamically when a client is trying to connect to the network. You need a Authentication Server (AS) to do this.

First, the Wifi access point (AP) is configured by the system manager to have a secure communication channel with the AS. And the client like your notebook need to be configured to have a authentication credentials (like your user name and password) that is used to get the client authenticated by the AS in the process.

Then when you try to connect the client to the network, the client first communication through the AP with the AS (at this time, you can only access the AS through the AP, other data like internet/LAN access is blocked by the AP) to authenticate each other and then generate the PMK, by this time both the client and the AS know the PMK. Then AS sends the PMK to the AP through the pre-established secure channel. Based on the PMK, all other Wifi secure communications begins.

Home Setup

Based on free software, it may be not that hard to use method 2 at home if you have enough Linux experience. Here is a potential reference: https://github.com/ouaibe/howto/blob/master/OpenWRT/802.1xOnOpenWRTUsingFreeRadius.md, I never used this, not sure whether it is easy to use.

Answer 2

From your description, this sounds like RADIUS authentication with WPA2 Enterprise (WPA2E).

WPA2E is the only WiFi standard I know of where a username is prompted for at connection time, rather than just a pre-shared key/password (or PSK).

As to your other question, yes, it is possible to do this at home, but you may need a different router. Most home routers do not support this form of authentication. You'll also need to set up a RADIUS server (free, open source ones exist) and go through a pretty involved configuration process.

You should also be aware that many consumer devices do not support WPA2E, so that's another issue to keep in mind. If you're planning on setting up a "lab" network at home that's operated like a real business network, it is reasonable to run a separate access point for your devices that don't support it, but for a real home user, this is overkill and you will spend more time troubleshooting than actually using your network.

Answer 3

This is called 802.1x authentication. According to Wikipedia:

IEEE 802.1X is an IEEE Standard for port-based Network Access Control (PNAC).... It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN.

Implementing this authentication method requires an authentication server and compatible access points and wireless clients. Many consumer access points do not support 802.1x.

A proper implementation of this authentication method is complicated to implement and maintain. It is not for the causal home user, though with some determination it can be used in a home environment.