PAP/CHAP sent from MS and returns access accept/reject PAP = Password identification protocol CHAP = Challenge/Handshake protocol Figure 6.17 RADIUS authentication TLS is application independent, allowing protocols like HTTP, FTP and Telnet to be layered on top of it transparently. The TLS protocol is able to negotiate encryption keys as well as authenticate the server before data is exchanged by the higher level application. The TLS protocol maintains the security and integrity of the transmission channel by using encryption, authentication and message authentication codes. A variety of cryptographic algorithms are supported by TLS-SSL. 6.7.5 WIRELESS TRANSPORT LAYER SECURITY (WTLS) WTLS is based on TLS. As opposed to TLS, WTLS can operate over UDP. The WTLS layer is modular and the application decides what security level and features it will use. Figure 6.13 indicates the layer position. 6.7.6 LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL (LDAP) LDAP is a protocol that is used by many applications to retrieve information in a library in a standardized way. The information could deal with: Persons and enterprises Configuration of software and equipment Certificates for different security services Authorization rules Support for QoS including traffic priorities in the network. Directory enabled network- ing (DEN) uses for example LDAP to store attributes and traffic classes. The LDAP protocol is an IETF standard (RFC1779). LDAP exists in a number of ver- sions. LDAPv3 has an improved functionality for national characters and cross-references between different servers. Contrary to many other TCP-based protocols, like HTTP, FTP Security and Telnet, LDAP uses coded commands over the network. The transaction coding is called binary encoding rules (BER). An alternative directory service with less success is called Whois + E-mail programs get LDAP support to search e-mail addresses. LDAP is an important part of Windows 2000 Active Directory and Netware NDS (Netware Directory Services). All versions of web browsers have support