Download to read offline
More Related Content
Similar to unit_3_AAA Wi-Fi Security_WLAN Security_2.pptxfdgf
unit_3_AAA Wi-Fi Security_WLAN Security_2.pptxfdgf
- 1. AAA Wi-Fi Security WLAN Security- WEP, WPA, WPA-2, radius, CHAP
- 2. Wifi-Security • needed tomanage remote access when users are moving Authentication infrastructure:- • The IEEE 802.1x standard recommends the usage of the RADIUS server (Remote Authentication Dial-In User Server). • Authentication can be conducted by a server located in the visited domain or outside it. • establishes a trust circle, through which an authentication message is supported by multiple servers linked together by security associations. Radio security. • Radio security’s aim is to ensure the confidentiality, integrity and packet signature. • delivered by protocols such as WEP (Wired Equivalent Privacy), TKIP (Temporal Key Integrity Protocol) or CCMP (Counter mode with CBC MAC Protocol) • protocols use keys derived from a master key, after the authentication process.
- 3. Wifi-Security Packet filtering • basedon the packet signature using keys derived from the authentication process • frames that enter the distribution system are safe (no risk of spoofing or disguise). • Filtering systems -access point or portal • destruction of illicit packets • services for QoS (Quality of Service) Access to remote services (roaming) • Access to remote services may be designed generically under the VPN (Virtual Private Network) • For example, implementation of secure inter-domains can be achieved using IPsec or SSL protocols.
- 4. Attacks on wirelessnetworks Passive Attacks:- • an unauthorized person obtains access to a resource without changing its content • Attacks may be passive eavesdropping or traffic analysis Features:- Eavesdropping Traffic analysis
- 5. Attacks on wirelessnetworks Active attacks • making unauthorized changes are made to messages and data flows or files Features:- Masquerade Replay Message modification Denial-of-service TCP attacks Trojan attack Dictionary attacks
- 6. IEEE 802.11 securitymechanisms • The access points used in wireless networks -broadcast data to all stations in their emission range. • a malicious user can enter the area of a network and retrieve information in order to obtain access to the network. • To overcome this problem, a client must establish a relationship, called an association with an access point. • A complete association with an access point requires the client to pass through three states: 1) non-authenticated, non-associated; 2) authenticated, non-associated; 3) authenticated, associated.
- 8. WEP (Wired EquivalentPrivacy) • broadcast on a radio wave • it is necessary to introduce a mechanism to protect communications from malicious eavesdropping • WEP is based on a symmetric cipher RC4 stream and was created to satisfy access control, privacy, authentication and integrity. • WEP is defined as an optional protocol, and the WLAN stations and the access points are not obliged to use it. • mechanisms defined in WEP are also optional • a station can use the authentication mechanism, for example, but not the encryption algorithm, and vice versa.
- 9. WEP (Wired EquivalentPrivacy) I. Access control to control access and not to permit users without authorization access to the medium. has two functions: authentication and authorization. Authentication makes it possible to check the identity of the client who wants to be connected authorization gives him the permission to enter the network. It is possible to be authenticated but not authorized. can be done on both sides of the communication: client and server sides.
- 10. WEP (Wired EquivalentPrivacy) II The SSID • The network identifier or SSID (Service Set ID) is the first mechanism of security offered by WEP for network access control. • The SSID is the name given to a network or domain. • The term “network name” is primarily used at the network configuration. • All stations and all access points belonging to the same network must have the SSID, even if the WLAN stations are in ad hoc mode or in infrastructure mode. • If one or more stations enter a network under the control of an access point, they must provide the SSID to the access point. • WLAN stations can access the network if they have the correct SSID.
- 11. WEP III The ACL(Access Control List) • Some Wi-Fi manufacturers implement the ACL on MAC addresses of the terminals • In this case, an access point performs the combination of a terminal only if the MAC address of the terminal is in its ACL. • MAC address is a unique address of every Wi-Fi or Ethernet card. • According to this address, WLAN stations can be recognized in the network. • ACL is an optional mechanism and can be configured only by the administrator of the access point.
- 12. WEP IV Confidentiality • transmittedframes in wireless networks are protected by encryption • Only the decryption using the proper static WEP key, shared between the terminal and the network, is allowed. • This key is obtained by concatenation of a secret key of 40 or 104 bits and an initialization vector (IV) to 24 bits. It is dynamically changed for each frame. The size of the final key is 64 or 128 bits
- 13. WEP IV Confidentiality • RC4algorithm performs the encryption of data in stream cipher. • RC4 key has a length of 8 and 2,048 bits. • key is placed in a generator of pseudo-random numbers, called RC4 PRNG (Pseudo-Random Number Generator), from RSA Laboratories. • This generator determines a sequence of pseudo- random bytes known as key stream or Ksi. • This series of bytes is used to encrypt a message, or Mi, with a classical Vernam protocol, performing exclusive XOR ( ) between Ksi and Mi. † • The result obtained from the exclusive XOR gives a new value, called Ci, such that:
- 14. WEP V Authentication • Twotypes of authentication procedures are available in WEP: open authentication and shared key authentication, which is a method of challenge/response. • Open authentication is the default process. • It contains no explicit authentication: a terminal can associate with the access point which is broadcasting its SSID and listen to all the data in transit within the BSS. • Shared key authentication provides a better level of security using a sharing key mechanism. The authentication occurs in four steps
- 15. V Authentication 1) Whena WLAN station requires an association with an access point, it sends an authentication request. 2) When the access point receives this frame, it sends to the WLAN station a frame containing a challenge of 128 bits generated by the WEP protocol. 3) The station copies the challenge in an authentication frame and encrypts it with the secret key, then its sends them to the access point. 4) The access point decrypts the message with the help of the secret key and compares it with the sent message. Then, it sends the result of authentication to the WLAN station.
- 17. WEP VI.Data integrity • TheICV is a CRC (Cyclic Redundancy Check) 32-bit based on the block. • To prevent changes to the messages conveyed, the ICV is encrypted with the same key as that used for encryption.
- 18. AAA • Authentication, Authorization,Accounting • Authentication identifies the user requesting access to network services. • Authorization limits the user’s access to permitted services only. • Accounting serves to count the network resources that are consumed by the user.
- 19. AAA • terminal interactswith the access router. • In the case where a terminal connects from a switched network (PSTN, ISDN, GSM), • access router becomes a NAS (Network Access Server) gateway that ensures the connectivity between the switched network and IP network. • Once it is physically connected to the network, the user terminal is authenticated. • only packets belonging to the authentication protocol and addressed to the AAA server are authorized and relayed by the NAS. • Upon a successful authentication, the NAS authorizes other packets coming from the user
- 20. AAA • two portsat the NAS: a controlled port and an uncontrolled port. • During the authentication phase, the traffic - controlled port After user authenticates, - second port. • From the operator’s point of view, the AAA client located on the NAS captures the authentication messages (e.g. EAP) coming from the terminal, encapsulates them into AAA messages, and sends AAA messages to the AAA server. • The AAA server accesses a database that stores all the information relative to the users and necessary for authentication. • AAA server and the terminal share a secret that allows the AAA server to authenticate the user
- 21. AAA • In thecontext of roaming, the AAA architecture defines domains of administration. • Each domain has its AAA server. • A mobile user is registered with his home AAA (AAAH) server of origin and can be authenticated by any visited network or domain through an inter-domain AAA protocol. • This inter-domain authentication is conducted by an AAA broker
- 22. AAA AAA functions for:– the terminal-NAS interface: two protocols are now envisaged for the transport of EAP messages, namely 802.1X and PANA (Protocol for carrying Authentication for Network Access) – the interface between the NAS and the AAA server for intra-domain which is provided by the RADIUS protocol – the interface between AAA servers for inter-domain which is implemented by the Diameter protocol
- 24. Authentication in wirelessnetworks • WPA and WPA2 protocols start with the client authentication RADIUS (Remote Authentication Dial-In User Server) Cisco Access Registrar is a RADIUS (Remote Authentication Dial-In User Service) server that allows multiple dial-in Network Access Server (NAS) devices to share a common authentication, authorization, and accounting database. Access Registrar tasks: • Authentication—determines the identity of users and whether they may be allowed to access the network • Authorization—determines the level of network services available to authenticated users after they are connected • Accounting—keeps track of each user’s network activity • Session and resource management—tracks user sessions and allocates dynamic resources all security information in a single, centralized database
- 26. RADIUS (Remote AuthenticationDial-In User Server) • Access Registrar is based on a client/server model, which supports AAA (authentication, authorization, and accounting). • The client is the Network Access Server (NAS) and the server is Cisco Access Registrar. • The client passes user information on to the RADIUS server and acts on the response it receives. • The server, on the other hand, is responsible for receiving user access requests, authenticating and authorizing users, and returning all of the necessary configuration information the client can then pass on to the user. • The protocol is a simple packet exchange in which the NAS sends a request packet to the Cisco Access Registrar with a name and a password. • Cisco AR looks up the name and password to verify it is correct, determines for which dynamic resources the user is authorized, then returns an accept packet that contains configuration information for the user session
- 27. Packet Exchange BetweenUser, NAS, and RADIUS
- 28.
- 29.
- 30. Types of RADIUSMessages • The client/server packet exchange consists primarily of the following types of RADIUS messages: • Access-Request—sent by the client (NAS) requesting access • Access-Reject—sent by the RADIUS server rejecting access • Access-Accept—sent by the RADIUS server allowing access • Access-Challenge—sent by the RADIUS server requesting more information in order to allow • access. The NAS, after communicating with the user, responds with another Access-Request
- 31. Proxying to anLDAP Server for Authentication
- 32. Challenge Handshake AuthenticationProtocol (CHAP) • is a three-way hand-shaking authentication protocol • provides greater security than PAP • password is kept secret; it is never sent online 1. The system sends the user a challenge packet containing a challenge value, usually a few byte 2. The user applies a predefined function that takes the challenge value and the user's own password and creates a result. user sends the result in the response packet to the system
- 33. Challenge Handshake AuthenticationProtocol (CHAP) 3. The system does the same. It applies the same function to the password of the user (known to the system) and the challenge value to create a result. If the result created is the same as the result sent in the response packet, access is granted; otherwise, it is denied.
- 34.