The Security Mechanism for IEEE 802.11 Wireless Networks - Case Study Example

The Security Mechanism for IEEE 802.11 Wireless Networks Number: Lecturer: Existing solutions to wireless connectivity and data communication have been exposed to increased security issues and hence affects their performance and effectiveness. There is an increasing demand for wireless data communication and networks in the current technological age. Consequently, there is need for more efficient and effective wireless communication platforms. The IEEE 802.11 wireless networks have recently become so popular in the industry due to their ability to provide mobility, flexibility and security in the access to information and information resources. This report provides a detailed description and elaboration of the IEEE 802.11 Wireless LAN’s security mechanisms. The report begins by providing an introduction to wireless networks, their vulnerabilities and how the IEEE 802.11 architecture can be used to employ security to the wireless networks. In this report, it is evident that IEEE 802.11 security mechanisms are the first and most effective and reliable ways to secure wireless networking. With the consistent and rapid evolution in technology and ways of computing, mobile computing and other wireless forms of data processing and computation will soon take over. Therefore, there is need for reliable and efficient security control mechanisms for wireless networks. Key Words. Wireless Networks; security mechanisms; WLANs; wireless Network standards. Table of Contents Abstract 2 1Introduction. 4 2Wireless Network Standards. 5 2.1The IEEE 802.11 wireless standards. 5 2.2The Relationship between the IEEE 802.11 and Wireless Technology. 6 3IEEE 802.11 Security standards and mechanisms for wireless connectivity. 6 3.1Service Set Identifier (SSID). 7 3.2WEP Algorithm. 8 3.2.1Encryption 8 3.2.2Authentication. 9 3.3MAC Address Filtering. 10 3.4 VPN 10 4Security weaknesses in the IEEE 802.11 security mechanisms. 11 4.1SSID Weaknesses. 11 4.2MAC address Filtering Weaknesses. 12 4.3WEP Weaknesses. 12 5Conclusion. 12 References. 13 1 Introduction. In the past year, there has been an increasing demand for wireless communication and connectivity from computing devices in organisations and individuals as well. This is occasioned by the need for mobile computing and data processing techniques that allow anywhere any time processing that can only be achieved by using the wireless connectivity. These processing techniques offer more reliability, flexibility and convenience (Gast, 2005). Statistics have also shown a tremendous increase in the number of internet users in the past one year, courtesy of mobile computing. This trend is projected to increase immensely in the future with organizations, individuals and even home users opting for wireless networks in place of the common wired network. This increased demand for wireless networks consequently requires some form of uniformity or standardization as well as security. Several organizations including the IEEE have tried to address this need by providing standardizations, specifications and extensions (Baghaei & Hunt, 2004). The institute of Electronic and Electronics Engineers (IEEE) 802.11 is a group that works and defines the set of specifications for wireless LAN technology in the world. Their main goal is to provide wireless communications with the required security level to enable secure and reliable wireless communication (Alicia, 2001). Despite its benefits of mobility, flexibility and convenience wireless networks has its fair share of drawbacks. One major drawback is the major security risks associated with wireless networks that need to be addressed. This report therefore, provides an analysis of the IEEE 802.11 security mechanisms for the wireless networks and how these mechanisms have addressed these security issues (Stephane, 2004). The report begins by providing an insight into wireless networks and the security issues associated with wireless networks. It will then provide a detailed explanation of the IEEE 802.11 security mechanisms that will address these security problems. 2 Wireless Network Standards. Many countries, organizations, manufacturers and different user groups are driven to work together to develop new standards due to the rise in the wireless systems, applications and technologies. These standardization groups have issued wireless standards including the HomeRF, HiperLan and the IEEE 802.11 standards. This section focuses on the IEEE 802.11 wireless standards (Stephane, 2004). 2.1 The IEEE 802.11 wireless standards. IEEE 802 committee approved the 802.11 Direct Sequence Spread Spectrum (DSSS) in 1997 to be used as a standard for wireless LANs that allows a bandwidth through put of 1 to 2 Mbps (Karen, Derrick, Matthew, & Tibbs, 2008). The IEEE DSSS standard offers a wireless connectivity that allows quick network setup in a limited time zone. The 802.11 standards support ISM radio frequency as well as the infrared as transmission media. The throughput was increased developing three 802.11’s extensions based on the new RF transmission techniques (Alicia, 2001). They include; i) 802.11a; this extension increased the throughput to 54Mbps. It also operates in the 5 GHz frequency wavelength that uses the unlicensed-National Information Infrastructure (U-NII) band (Gast, 2005). ii) 802.11b; this is a standard that increased the throughput to 11Mbps and is similar to the Ethernet 10baseT. It operates in the 2.4GHz frequency (Stephane, 2004). iii) 802.11g; this is the standard extension that is viewed as a go between the 802.11a and 802.11b. This standard offers a theoretical throughput of 54Mbps and is compatible with both the 802.11a and 802.11a standards. Additionally, the 802.11g standard will be the most used standard suitable for implementation of wireless network technologies (Alicia, 2001). 2.2 The Relationship between the IEEE 802.11 and Wireless Technology. WI-FI (Wireless- Fidelity) certification is given to the 802.11 products that are compatible and interoperable with other Wi-Fi products. Their main concern is to ensure the interoperability of the products from all the 802.11 standards and all other wireless products from other standards (Stephane, 2004). This certification is normally given by the Wi – Fi alliance, which also defined the WPA (Wi – Fi protected Access) and the Wi – Fi Zone for the expanding market for wireless networks and connectivity. These specifications, standards, and certifications are relevant for the 802.11 wireless connectivity. Therefore, the next section will identify the IEEE 802.11’s security mechanisms for the wireless networks (Stephane, 2004). 3 IEEE 802.11 Security standards and mechanisms for wireless connectivity. With the increase in popularity of the wireless networking and communication, there are also major challenges in roaming, configuration and security. Most of the data are subjected to security threats ranging from eaves dropping, through the radio frequencies (Gast, 2005). Therefore, these wireless networks must be secured to enhance reliability and security in data communication. Conventionally, wireless traffic is transmitted through the open air via the radio waves, consequently, proper security mechanisms must be installed to prevent against possible security threats (Karen, Derrick, Matthew, & Tibbs, 2008). The IEEE 802.11 has developed a set of security standards and mechanisms to secure wireless connectivity and networks. These set of mechanisms and security features include (Alicia, 2001): Service set identifier (SSID) Wireless Equivalent Privacy (WEP) Algorithm. MAC Address Filtering. Virtual Provate Networking (VPN) Across radio frequency. Access Control list These mechanisms can be deployed individually but deploying all four mechanisms ensures a more secure and reliable security framework. 3.1 Service Set Identifier (SSID). This is an identity verification mechanism that is often used in the access point or group of access points that is used to identify which subnet mask one exists in. it works by segmenting the wireless network in multiple networks and using it as a form of authentication. In case the wireless station doesn’t know the value of the SSID then, access to the access point is denied. The SSID acts as some form of password hence providing security (Alicia, 2001). However, if the SSID is used alone the security is weak due to the fact that the value is known by all network cards and access points; hence it is easily accessed through radio waves and the air because of lack of encryption. Access points are configured to broadcast the SSID hence any client can be able to receive it and hence access the access point. Additionally, users can be able to configure their own client systems with appropriate SSID, because SSIDs are easily shared and are widely known (Baghaei & Hunt, 2004). 3.2 WEP Algorithm. The WEP security protocol and mechanism provides security against eavesdropping and physical security attributes. This is the encryption standard that has been specified by the IEEE 802.11 network architecture. Essentially, the WEP algorithm encrypts data and information and protects it from unauthorised users. The mechanism uses a 40- bit secret key for encryption and authentication. Other IEEE 802.11 standards allow the 104 – bit secret key encryption (Alicia, 2001). 3.2.1 Encryption Once WEP is enabled, all the data is encrypted using the Ron Rivest code 4(RC4) to provide security for data to be transmitted. WEP also protect the wireless traffic using a 24- bit initialization vector (IV) that is randomly generated (Stephane, 2004). This IV is combined with 104-bit or 40-bit shared secret key. The encryption process involves: First, the 40-bit shared key is concatenated with the 24-bit IV. The IV introduces cryptographic variance to the shared secret key hence increasing security. Now there is a new 64- bit key that is fed to the RC4 algorithm hence creating the encryption key. The data is protected against modification by checking for integrity using the cyclic redundancy Chech-32(CRC-32). This process generates 4 bytes CRC that will be used together with the encryption key to generate an encryption output. This output is sent to transmission where the recipient will use reverse steps to decrypt the data (Stephane, 2004). 3.2.2 Authentication. WEP authentication mechanism uses the same secret key that was used in the encryption process. There are two possible authentication ways namely open system authentication and Shared Key authentication (Gast, 2005). 3.2.2.1 Open system Authentication. This is the default authentication mechanism that works in two steps: i) The client that wishes to join the wireless network sends an authentication request. ii) The Access point in turn checks the shared secret key and replies with a positive or negative answer. In this mechanism, neither the client nor the Access point has the privilege of authenticating each other. 3.2.2.2 Shared Key Authentication. In this mechanism, the access point issues an encrypted challenge packet to clients once encryption is enabled (Alicia, 2001). Each of this is broadcasted to any client that is attempting to connect to the access point. The client then uses the key to encrypt the correct response so as to authenticate itself. Both the client and the access point use the same key for encryption and subsequent decryption of data (Alicia, 2001). All the encryption keys in the WEP algorithm that are used in a wireless network should be manually managed since there are no protocols for managing the keys in WEP and for distribution as well (Baghaei & Hunt, 2004). One of WEP limitations is that it can only be implemented on a client /server wireless network having an access point but cannot work on a peer-to-peer network. The other weaknesses associated with the WEP algorithm is that the WEP keys encryption and authentication is static thus making it susceptible to traffic injection, statistical attacks and password replays among other threats (Karen, Derrick, Matthew, & Tibbs, 2008). Regular change of WEP key reduces the risks of unauthorised access to the access point, and eaves dropping among other security threats (Karen, Derrick, Matthew, & Tibbs, 2008). Hackers have exploited this security loop hole in the past by intercepting the traffic and flipping the bits and injecting modified packets into the network. The IEEE 802.11 WEP security mechanism is mainly concerned with three goals; Data integrity, access control and confidentiality. For better effectiveness in securing wireless networks WEP mechanism is deployed together with the SSID security standards (Alicia, 2001). 3.3 MAC Address Filtering. Client computers in a wireless network have different MAC address for its IEEE 802.11 network card. Every access point in a network has a list of authorised MAC addresses that are only allowed to access the Access point. This list is inputted manually and must always be kept up to date. Due to this cumbersome process of creating and maintaining the list, it is suitable for smaller networks. The security of such a network can further be reinforced by using the IEEE 802.11 WEP and the SSID together with the MAC address filtering (Stephane, 2004). 3.4 VPN An alternative to the three mechanisms is the incorporation of the VPN solution to a high security network. This mechanism provides a dedicated and secure channel over an un-trusted network particularly the internet (Gast, 2005). The VPN has a server and a VLAN interfacing the access point and the VPN server. The VPN server acts as a gateway to the private network and provides full encryption as well as authentication (Karen, Derrick, Matthew, & Tibbs, 2008). The VPN mechanism is mainly develop to provide users with a more secure way of connecting to the network using the internet. This connection is established through a secure VPN using the different tunnelling protocols (Alicia, 2001). Additionally, the VPV mechanism provides a logical solution to wireless networks due to the fact that it provides an access control that protects against unauthorised routes to the network (Stephane, 2004). 4 Security weaknesses in the IEEE 802.11 security mechanisms. The security mechanisms defined by IEEE 802.11 are intended to provide security to wireless networks through authentication, access control and data encryption. However, these mechanisms have some limitations and cannot provide maximum security against some sophisticated attacks (Alicia, 2001). 4.1 SSID Weaknesses. SSIDs are periodically broadcasted by the Access Point to all the wireless devices that are in range. The wireless devices with the correct SSIDs can automatically discover and join the wireless network. Consequently, this makes it easy for attackers to find the SSID and access the network without authorization. The broadcast feature of the Access Point can be disabled and the SSID configured manually by each client. With the broadcasting off, attackers can still gain access to the SSID during the association phase. The SSID will then be transmitted during the association request between the client and the access point and hence an attacker may intercept the transmission and gain access to the SSID (Baghaei & Hunt, 2004). Attackers may also gain easy access to a default SSID, this happens when the client or user does not change the default SSID which in this case makes it easy for the attacker to guess and gain access to the wireless network. 4.2 MAC address Filtering Weaknesses. The ACL or in this case MAC address filtering has some vulnerabilities that result from the possibility of an attacker identifying the authorised MAC addresses. This is possible due to the fact that ACL or MAC address filtering allows the Access point and the network administrator to maintain a list of authorised address. Hence, the attacker can use one of the MAC addressed and deceive the Access point into gaining authorization into the wireless network (Alicia, 2001). 4.3 WEP Weaknesses. The WEP mechanism has vulnerabilities both on authentication and encryption. The major cause of these vulnerabilities is the fact that every component has possible security weaknesses (Alicia, 2001). First, the shared security secret keys are configured manually during installation and are rarely changed. Secondly, the use of RC4 algorithm is susceptible to various security threats that can expose the WEP shares secret key. Thirdly, there is possibility of repeating the IV hence causing IV collision. This opens a loop through which the attacker can collect enough data to depict the secret key. Finally, the CRC-32 can be modified by an attacker in a manner that the recipient won’t realise since it will appear valid (Baghaei & Hunt, 2004). 5 Conclusion. The IEEE 802.11 security standard and mechanisms are the first platform towards wireless networks security. Since the inception of these security mechanisms, there have been changes that have been made to the subsequent mechanisms to enhance their effectiveness in ensuring wireless network security. It is however important to note that a combination of the several mechanisms is a more reliable way of securing wireless networks using the IEEE 802.11 networks. References. Alicia, L. (2001, November 24). The Security Mechanism for IEEE 802.11 Wireless Networks. Retrieved November 26, 2014, from Sans.org: http://www.sans.org/reading-room/whitepapers/wireless/security-mechanism-ieee-80211-wireless-networks-158 Baghaei, N., & Hunt, R. (2004). IEEE 802.11 wireless LAN security performance using multiple clients. In Networks. 12th IEEE International Conference. 1, pp. 299-303. IEEE. Gast, M. (2005). 802.11 Wireless networks: The definitive guide. OReilly Media, Inc. Karen, S., Derrick, D., Matthew, S., & Tibbs, C. (2008). Computer Security:Guide to securing Legacy IEEE 802.11 Wireless Networks. National Institute of Standards and Technology, Department of Commerce. Gaithersburg: NIST. Stephane, G. (2004). Wireless Security and the IEEE 802.11 Standards. London: SANS Institute. Read More