For any security solution to have a ghost of a chance, you have to have some way to ensure that your users, and the devices they are using, are trusted users/devices. But how do you do that? Well, one way is to use a standard kind of authentication, which in today's wireless world means 802.1x authentication. This tip, excerpted from InformIT, discusses the 801.11 standard, and the .ix follow on authentication protocol.
Vendors and network specialists have realized the weakness in wireless protocols and have attempted to build protection into the wireless network connection standard known as 802.11. However, this requires that the user understand and incorporate a pass phrase, encryption scheme and more. Unfortunately, users do not always put security as their first priority. Because of this, many wireless networks are wide open to attack by anyone with a laptop. In fact, hackers (and security specialist) have learned that it only takes a few minutes of driving around a city with a laptop scanner to find a vulnerable network (this is known as "War Driving.")
The 802.11 standard permits a network to be made relatively secure if the user sets up their wireless network using WEP. The Wired Equivalent Privacy (WEP) algorithm is a collection of security services that, if used properly, protect the wireless network from being compromised. Due to the very nature of the wireless medium, ie, the air, it is a simple task for a device to 'listen' to the data and grab sensitive information such as passwords. WEP consists of the previously mentioned pass phrase or encryption that uses secret, shared encryption keys that are generated by the host and then passed to the clients. These keys then alter the data that travels across the airwave, thus thwarting anyone using a sniffer on the network.
The two main types of authentication are properly known as:
- Open System: The open system requires that the requesting station send its identification to the authenticating station, which either accepts or rejects the connection based on whether or not the identity is recognized.
- Shared Key: The shared key system requires that a secret key is known by both the authenticating station and the requesting station. When a connection is attempted, the secret key is sent from the requesting station and is either accepted or rejected by the authentication station.
When Shared Key authentication is chosen, the user has the option to use the key to encrypt the data. As previously mentioned, this can protect sensitive data traveling across the wireless network from becoming captured. Since the key can be of different lengths, the user is in control of how strong they want the encryption (40 – 104 bit). The bit strength corresponds logarithmically to how many guesses it would take to crack the code.
If a wireless network is using 802.11 authentication, the user can specify up to four different keys. Each key is assigned an index number (0-3). When data is passed from the requesting station to the authentication station, the index number is included and the authentication station uses the relative key to decipher the data.
Under 802.11, a wireless station can be configured with up to four keys (the key index values are 0, 1, 2, and 3). When an access point or a wireless station transmits an encrypted message using a key that is stored in a specific key index, the transmitted message indicates the key index that was used to encrypt the message body. The receiving access point or wireless station can then retrieve the key that is stored at the key index and use it to decode the encrypted message body.
However, even with the proper use of 802.11, including a strong password and encryption, hackers can capture the data. [...] the weakness is found in the fact that the encryption scheme is predictable. With only a few minutes of captured data, a savvy hacker can compromise a network. As a result, since Microsoft is genuinely concerned about our safety, they adopted the new, more secure 802.1x standard in Windows XP.
802.1x takes it predecessor, 802.11, one step farther. Although it does support 802.11 authentication, 802.1x includes the ability to use computer and user identification, dynamic key creation, and centralized authentication. These extras make 802.1x more secure and eliminate many of the vulnerabilities of 802.11, according to leading industry developers (e.g. Microsoft and Cisco).
Included in the 802.1x standard is support for the Internet Authentication Service (IAS). IAS uses the Remote Authentication Dial-In Service (RADIUS) protocol, which turns the wireless access point into a client for a central RADIUS server that handles the connection request. If the connection is approved, the RADIUS server provides a unique key for each new wireless connection session. In addition, 802.1x supports the Extensible Authentication Protocol (EAP) that gives users the ability to use smart cards, certificates, the Message Digest 5 (MD5) encryption algorithm, and more as their method of authentication.
For example, using 802.1x authentication gives a hotel the power and the means to set up a wireless hotel that can allow patrons access to the Internet and their email, while keeping the patrons from accessing private parts of the network or other guest computers. This assumes that each guest has a wireless network card in her computer, PDA, or Pocket PC and it is configured for such use.
To read the entire article from which this tip comes, click over to InformIT. No registration, no muss, no fuss; just good info.
