Zte ZXR10 2900 Series User Manual page 185

The Radius Accounting Server is responsible for receiving the sub-
scriber billing start request and subscriber billing stop request, and
completing the billing function.
The NAS communicates with the Radius Server through RADIUS
packets. Attributes in the RADIUS packets are used to transfer
the detailed authentication, authorization, and billing information.
The attributes used by this switch are primarily standard attributes
defined in the rfc2865, rfc2866, and rfc2869.
The EAP protocol is used between the switch and the subscriber.
Three types of identity authentication methods are provided be-
tween the RADIUS servers: PAP, CHAP, and EAP-MD5. Any of the
methods can be used according to different service operation re-
quirements.
� PAP (Password Authentication Protocol)
PAP is a simple plain text authentication mode. NAS requires
the subscriber to provide the username and password and the
subscriber returns the subscriber information in the form of
plain text. The server checks whether this subscriber is avail-
able and whether the password is correct according to the sub-
scriber configuration and returns different responses. This au-
thentication mode features poor security and the username
and password transferred may be easily stolen.
Figure 72 shows the process of using the PAP mode for identity
authentication.
F 72 USING PAP MODE FOR IDENTITY AUTHENTICATION
IGURE
� CHAP (Challenge Handshake Authentication Protocol)
CHAP is an encrypted authentication mode and avoids the
transmission of the user's real password upon the setup of
connection. NAS sends a randomly generated Challenge string
to the user. The user encrypts the Challenge string by using
the own password and MD5 algorithm and returns the user-
name and encrypted Challenge string (encrypted password).
Confidential and Proprietary Information of ZTE CORPORATION
Chapter 7 Service Configuration
173