Secure enterprise Wi-Fi access: EAP-TLS on Azure Sphere

This article is contributed. See the original author and article here.

For enterprise and industrial customers with connected equipment and devices, a higher level of network security is an important part of protecting business-critical investments and infrastructure. When bringing connected devices onto a corporate network, customers want control and visibility over exactly what devices are connected. Instead of authenticating a device to a network using a password, which can be shared among multiple devices, secured enterprise Wi-Fi relies on mechanisms to support unique authentication of each device.

 

Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) is a common authentication method used in such security-focused, enterprise scenarios. Azure Sphere supports the EAP-TLS protocol to secure the connections to an access point via certificates on a device. The use of device certificates is more secure than sharing a global key among all devices.

 

To use EAP-TLS to connect to an access point, the network administrator must configure a RADIUS server and the access point(s) for WPA2-Enterprise and EAP-TLS. In this scenario a certificate authority (CA) generates client and server authentication certificates for the devices as well as the RADIUS server.

 

This post does not cover the details for the customer network configuration or PKI components; these items are well documented for network administrators setting up an enterprise network. Azure Sphere’s implementation on the client ensures that the customer maintains control over the existing network and security infrastructure.

 

This post will cover the basic steps needed to load a valid certificate, to configure a new EAP-TLS network with the certificate, and to connect to your secured network via the command line or programmatically.

 

How to get started

Certificate acquisition

In the 20.04 release of the Azure Sphere OS, we added the ability to connect to a secured Wi-Fi network via EAP-TLS. There are multiple ways a device can acquire a certificate with the private key. Which pattern you choose to use depends on your network as well as your manufacturing and distribution process, but it can be summarized into two methods:

1. Sideload the data during manufacturing or upon delivery of a device from a connected computer that contains the data and uses the azsphere command line interface to load it.
2. Bootstrap the data via an existing open or PSK network which has internet access. In this scenario, you must ensure there is a secure delivery mechanism, such as an on-premises web service that can authenticate, manage, and securely transport the certificate and private key to the device.

Certificate formats

Azure Sphere supports RSA x509 certificates in the .PEM file format in PKCS1 and PKCS8 syntax. Azure Sphere devices have about 24KB of onboard storage for certificates, managed by the OS. Applications can use the Certstore API to manage the certificates.

 

Enable secure enterprise Wi-Fi access using the azsphere command line tool

During testing and development, use the azsphere command-line tool to quickly iterate and test device connectivity.

 

New functionality in azsphere device certificate allows certificate management

Verb	Information
add	Adds a certificate to the attached device’s certificate store.
delete	Deletes a certificate from the attached device’s certificate store.
list	Lists the certificates in the attached device’s certificate store.
show	Shows details about a certificate in the attached device’s certificate store.
show-quota	Displays the available free space in the attached device’s certificate store.

 

New parameters in azsphere device wifi add

Verb	Information
clientcertid	A string value (up to 16 characters) that identifies the client certificate (containing both the public and private key). Required to set up an EAP-TLS etwork.
clientid	ID recognized for authentication by this network’s RADIUS server. Required for some EAP-TLS networks.
rootcacertid	A string value (up to 16 characters) that identifies the server’s root CA certificate for EAP-TLS networks where the device authenticates the server.

 

Programming model

Before an application can load certificates, its application manifest (app_manifest.json) must include the new CertStore capability. Likewise, to enable secure enterprise Wi-Fi access, the application manifest must include the EnterpriseWifiConfig capability.

 

The certificate data consists of the client authentication certificate, its corresponding private key, and the public certificate for the RootCA of the RADIUS server. After this data is loaded, the application must set the WifiConfig_Security_Wpa2_EAP_TLS flag used to indicate that the Wi-Fi security type is EAP-TLS.

 

The certificate data is then associated with the network, so the device can connect to the network using the specified client ID and certificate data.

 

Next Steps

Check out the EAP-TLS feature overview: https://docs.microsoft.com/azure-sphere/network/eap-tls-overview

Samples are available:

1. Loading and managing certificates: https://github.com/Azure/azure-sphere-samples/tree/master/Samples/Certificates
2. Configuring secure enterprise Wi-Fi access: https://github.com/Azure/azure-sphere-samples/tree/master/Samples/WiFi/WiFi_HighLevelApp

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.