Securing a Wireless Network

WLANs (Wireless LANs) are based on the IEEE 802.11 standard. Once the standard was defined, to avoid interoperability problems between IEEE 802.11 products from different vendors, the Wi-Fi alliance was formed. The alliance coined the term Wi-Fi for WLANs based on 802.11.

Initially IEEE 802.11 had only one method for security called WEP (Wired Equivalent Privacy). But as WLANs became popular, flaws in it were detected and tools to break the WEP security were easily available on the Internet. In our August 2003 story on wireless networks we pointed out the weaknesses in WEP and even cracked the WEP key using a popular and freely available tool.

But this does not mean that WLANs are not secure. Those in the business of security know that there is no such thing as absolute security, but you can make it tougher to breach, so that the chances of a break-in are reduced. There are many ways to do this, starting from using MAC address-based filtering to the new IEEE 802.11i security standard, including IEEE 802.1x and WPA. Let's see how and where to use these security measures and evaluate the potential risk involved with them.

WEP Security



In the WEP security model, the AP is the decision maker to allow people to access the WLAN. If the WEP key is correct the user can access the network, if not he is denied. An attacker after cracking the correct WEP key can use the WLAN with no problems.

MAC address based filtering



This is the second line of defense against attackers after WEP, using which you can configure your wireless AP or router to accept packets only from known MAC addresses. Then, even if some undesired person hits the correct WEP key, he still can't access the network. But this method also has its shortcomings. MAC addresses are very easy to fake or spoof and they flow in clear text over the air. Nonetheless, it is a better approach than WEP and most APs and routers support this feature. This can be an easy and fast solution for small networks. A few APs also provide MAC plus IP address filtering, making it even tougher to break, as you now need the correct combination of IP and MAC addresses even after getting a valid WEP key.

IEEE 802.11i and WPA



IEEE 802.11i is a new generation security standard for wireless networks. It defines a new type of wireless network called RSN (Robust Security Standard). RSN requires the wireless devices to have number of new capabilities as defined in the new standard. However, customers would not like to dump their existing products and also the standard is still not released. So the Wi-Fi alliance has adopted a new standard based on RSN, called WPA (Wi-Fi Protected Access).

Three-party security model of WPA and IEEE 802.11i



The new standard based on WPA describes a different security model. The model takes a three party approach instead of the two party approaches used earlier. When a user wants to connect to a wireless network he first connects to the AP. But now the AP itself cannot allow the user to access the network. Instead, the AP connects to a separate AS (Authentication Server), which takes the decision whether a user should be permitted or not. This way even with a valid WEP key, a user cannot access the WLAN until permitted by the AS. In this case the AP becomes the NAS (Network Access Server), whose job is to control the access gate to the network under the direction of the AS. IEEE 802.11i also takes the same approach.

Coming to the practical implementation of the security models, there are various security and communication protocols present to be used between the user and AP and between the AP and the AS, with different vendors offering different features. The IEEE 802.11i is meant to standardize this through the RSN model, but it is still not out. In the next article we will explain a solution using PEAP (Protected-EAP), IEEE 802.1x and RADIUS. This solution is one of the preferred configurations in the WPA standard, but other solutions are also possible. Further, we will build a three-party wireless network using the above method.

Protocols for wireless security EAP



In a WLAN, for the user to connect to the network it needs to identify itself to the AS. This is done by using EAP (Extensible Authentication Protocol). Using EAP messages, the user provides his identity to the AP, which forwards it to the AS for authentication. Depending on the user information the AS gives a success or failure signal to the user. In this method the user identity is passed on unprotected, which can be easily snooped by an intruder. Then the intruder can disguise as a valid user to access the network and you have no means to tell whether data is coming from the right source. 

EAP messages between the user and the AP are transported over the EAP on LAN (EAPOL) protocol. It is like the PPP connection used for dial-up Internet access.

Upper Layer Authentication built on EAP



To avoid this, upper layer authentication such as TLS, Kerberos, LEAP (Cisco) or PEAP are used in conjunction with EAP. After the initial identification is done by EAP, the AS defers success or failure of the EAP session until the above

authentication methods are not sure whether the user information is coming from the correct source.

PEAP



We will use PEAP for our implementation and it is slightly different in approach than other methods. It prevents user identity to fly in the air unprotected. It provides a mutual authentication in which first the AS proves its identity to the client using, say, a digital certificate and also gives the user the public key of the certificate. After this the user identity can be sent to the AS encrypted with the public key of the server. This encrypted information can only be read by the AS using its private key and not by any intruder.

IEEE 802.1X



Above we saw that EAP messages are used to communicate between the users and AS, but how can a user talk to the AS when he is not authenticated to use the WLAN. The situation is handled by 802.1x. IEEE 802.1x implements access control where a user joins the wireless network, which is the AP. Its job is to establish a temporary connection with the user on which only EAP messages can be communicated to and from the user. EAP messages from the user are passed onto the AS and messages from AS are passed to the user. In between the 802.1x AP looks for special EAP messages like success or failure to finally connect or disconnect the user. 

If the user is successfully authenticated the connection is established and data can flow between the user and the network 



using the wireless link. 

RADIUS (Remote Authentication Dial-in User Service) Server



Till now we have talked about the mechanisms of EAP, the link on which it operates between the AP and the user. But we have not talked about the protocol over which EAP messages are sent to the AS. The AS and the NAS, which are logically two separate entities, can be physically built together into the AP. So, the NAS can directly talk to the AS. But in this case the authentication mechanisms are limited and you have to create separate user lists for each AP. Instead a better way is to have a dedicated AS with the user lists with which the NAS communicates. This communication between the NAS and AS is done using RADIUS protocol, which was originally designed for dial-up Internet users. So in a WLAN, AS is basically a server running RADIUS protocol supporting EAP extensions to authenticate wireless users on the basis of user list present on it. The AS should also support other upper layer protocols, if you wish to use it in your network. To use the above security model, you will need support at all three levels: the client system, the AP and the AS. As a client, Win XP by default has support for 802.1x, for previous versions several other vendors are providing support. Open source implementations are available for Unix/Linux clients. For the APs, Cisco and D-Link products support 802.1x. Older products can be upgraded with the latest firmware to support 802.1x. On the server side Windows 2003 server provides necessary support, while third party solutions are also available for previous versions. For Unix/Linux, OpenSSL and FreeRadius can be used for 802.1x.

Anoop Mangla