Security in Mobile and Wireless Networks
Total Page:16
File Type:pdf, Size:1020Kb
Security in Mobile and Wireless Networks APRICOT Tutorial Perth Australia 27 February, 2006 Ray Hunt, Associate Professor Dept. of Computer Science and Software Engineering University of Canterbury, New Zealand 1 Security Issues in Wireless and Mobile IP Networks Section 1 - Wireless & Mobile IP Architecture, Standards, (Inter)operability, Developments Section 2 - Cryptographic Tools for Wireless Network Security Section 3 - Security Architectures and Protocols in Wireless LANs Section 4 - Security Architectures and Protocols in 3G Mobile Networks 2 1 Wireless & Mobile IP Architecture, Standards, (Inter)operability, Developments (Section 1) 3 Outline Wireless LANs – Standards, Architecture IP roaming Wireless security and authentication QoS (Quality of Service) Integration of 3G and WLANs New Developments by IEEE - Broadband Wireless Access 4 2 Wireless IP Networking Revolution Past Present Future Paradigms Demand Solutions Local Area WLAN - On campus Unlicensed Bands Fixed - At home Data • Personal mobility Mobility • High data rate Combined with • Incremental infrastructure Network “handoff” Connectivity (Data + Voice) “3G” WCDMA Wide Area Mobile Licensed Bands - On the road Voice • Full mobility • Modest data rate • All new infrastructure 5 Recent WLAN Activity …. IEEE and ETSI involved in standardisation WLAN standards are converging to achieve interoperability Integration of WLAN and 3G appearing Wireless IP momentum - rapid growth in requirements for mobile IP access WLAN offers good mobile solution for indoor IP access Major players investing in WLAN (CISCO, Intel, Ericsson, Nokia, others …) 6 3 WLAN Architecture Standards, MAC Layer, Frequency Spectrum, Speed/Distance 7 Standards Organisation in IEEE IEEE Standards Association Standards Activities Board Sponsor Sponsor Sponsor Local and Metropolitan Area Networks (LMSC, IEEE 802) 802.3 802.11 802.15 802.16 802.5 CSMA/CD CSMA/CA Wireless Broadband Token Passing Ethernet Wireless Personal Wireless Ring 1-100 Mbps WLAN Area Networks Broadband Access IEEE 802.11: ~650 Members, 250+ supporting companies www.ieee802.org/11 8 4 WLAN Standards Evolution 2.4 GHz (BW 80 MHz) 5 GHz (BW 450 MHz) ETSI BRAN Proxim OpenAir FH HyperLAN/1 1996 1.6 Mbps 24 Mbps 1997 IEEE 802.11 FH IEEE 802.11 DS 1, 2 Mbps 1, 2 Mbps 1998 IEEE802.11a HomeRF FH IEIEEEE E80 820.121.1b1 Hb R 1999 OFDM 1.6 Mbps 1, 2, 5.5, 11 Mbps Replaced by 54 Mbps IEEE 802.15 IEEE 802.11 P2A0N0s0 -(52004) Extensions EETTSSII BBRRAANN eg Bluetooth 802.11g (54 Mbps) HyippeerrLLAANN//22 802.11a (54 Mbps) 54 Mbps Under IEEE 802.16a/e Development IEEE 802.20 9 2006 Broadband Access ISO Model Applied to WLANs Application LLC provides traditional HDLC type protocol Presentation MAC controls access to the physical Session channel according to a predetermined set of rules Transport Network Logical Link Control (LLC) Main differences: Datalink • Radio link unreliable Medium • Higher error rate Access Control (MAC) • Security risks Physical • All traffic goes via AP (Access Point) 10 5 MAC Overview IP Packets MAC Layer Management Entity (MLME) MAC DSAP • Retransmission, error correction radio mgmt association Fragmentation e.g. scanning management & ARQ power shared-key WEP (RC4) & AES authentication encryption management • Radio link security • Data authentication • Data encryption management addressing framing info base (MIB) • Simple scrambling • Peer-to-peer • 48 bit MAC address CSMA/CA • Ethernet compliant channel access • Unique identifier • Radio link QoS • Multicast and • Dedicated real-time PHY SAP broadcast support support with 802.11e 11 Key Wireless LAN Technologies Older technologies limited speed to 1-2 Mbps Significant developments by IEEE 802.11 Variety of standards speeds up to 54 Mbps IEEE 802.11a/b/g (11 & 54 Mbps) - popular To compete with traditional LANs, wireless must offer: cost effect solutions security efficient power management 12 6 Key Wireless LAN Technologies IEEE 802.11b (11 Mbps) 2.4 GHz (Wi-Fi) IEEE 802.11a (54 Mbps) 5 GHz (Wi-Fi5) IEEE 802.11g (54 Mbps) 2.4 GHz IEEE 802.16 / 802.20 Broadband Wireless Access Standard (Wireless MANs) Bluetooth Wireless PAN (Personal Area Network) 2.4 GHz (= IEEE 802.15) www.bluetooth.com HomeRF (1.6 Mbps) 2.4 GHz www.homerf.org 13 Courtesy UMTS Forum 14 7 WLANs: Speed/Distance Scenarios 54 Mbps Wireless Multimedia + 802.11a 802.16 802.11g IEEE 802.11b 802.20 dominates in products 802.11b 11 Mbps Wireless Local Area Coverage 5,5 Mbps 2 Mbps 802.11 1 Mbps 3G WANs 500 Kbps 10m 30m 60m 100m 200m > 400m 15 IEEE 802.11 Standards contd ... ATM Speed IEEE 802.11g Ethernet Speed16 8 “Actual” Realistic Speeds MAC / PHY overhead Higher rate & PER -> lower throughput PER: Packet Error Rate Courtesy of Atheros 17 IEEE 802.11a/b/g IEEE 802.11 Working Group provided extensions to 802.11b for data rates above 20 Mbps leading to IEEE 802.11g IEEE 802.11g offers 802.11a data rates in 2.4 GHz band and requires mandatory implementation of IEEE 802.11b modes This standard provides a path for development of multi-mode WLAN products IEEE 802.11a IEEE 802.11g IEEE 802.11b 18 9 Summary of Key Differences Standard Distance (m) Speed (Mbps) Power (mw) IEEE802.11b <100 11 (~6) 50-100 IEEE802.11g <100 54 (~30) 50-100 IEEE802.11a <50 55 (~30) 200 Bluetooth 10-100 1 1 (10m) 100 (100m) 19 Additional Requirements ….. IP Mobility between WLAN subnets and into 3G networks Authentication - local and remote Security across the airwaves, end-to-end, Wireless LAN, Wireless WAN (3G) Quality of Service - to support time dependant applications 20 10 WLAN - Plain Wireless Ethernet Extension for IP Mobility Application Level Data Applications Support for Application fixed and mobile IP features essential (especially sNeceutwriotyrk! )addressing, routing TCP/IP TCP/IP stack Access Point IP routing Other 802.11 802.11 Ethernet Ethernet LAN WLAN WLAN Ethernet interface radio radio 21 Design Challenges for IP Mobility Roaming IP devices with changing IP address, service location and ISP IP backbone and access networks have not been designed for mobile stations Wireless link is vulnerable to security attacks Wireless link subject to QoS (Quality of Service) deterioration 22 11 Challenges for IP Mobility How to How can I get authenticate An IP address the user ? How to protect How can I have corporate data? secure connection? How do I seamlessly hand off between How to find Internet WLAN and 3G Roaming services, printer? IT WLAN manager User Corporate LAN How to bill the user? Firewall Public ISP 23 Essential WLAN Mobility Support DHCP server x.x.x.x DHCP server y.y.y.y Sub-network A Sub-network B Access Point A Access Point C Access Point B WLAN terminal IP = y.y.y.y MOBILE IP needs to support WLAN terminal IP address transparency, WLAN terminal IP = x.x.x.x security and QoS IP = x.x.x.x • IEEE 802.11 defines LAN level (AP-2-AP) mobility • Forwards handover • Maintains same IP address 24 12 Multiple Authentication Required Global AAA & PKI Architecture required Authentication can be for roaming Banks etc. carried out in company or by ISP AAA server Internet AAA server • Smart cards desirable • Standards required to support smart card and Service AAA mechanisms provider authentication Local ISP Network AAA WLAN server network WLAN terminals ISP service with integrated authentication smart card reader 25 Security Components... Client WWAN (3G) Host application - via WAP2.0 including WLAN (IEEE802.11) IPSec and TLS/WTLS - via IEOEEpt8io0n2a.1l x e/EnAd-Pto-end Data Encryption -> Privacy or VPN Tunnel • Key management Access and PKI needed TCP/IP TCP/IP stack Controller for secures taadck-hoc networking IP packet encryption / authentication • IPSec aware QoS 802.11 WLAN offers AP • IPSec and IKE radio link packet authentication and used for security data encryption critical access (RC4/AES) • IPSec policy WLAN WLAN management WLAN encryption should be defined • AAA needed for global roaming • Remote access IPSec needed 26 13 Hotspot Service with IPSec IPSec or L2TP used to IPSec used to encrypt encrypt Core Network traffic Access Network traffic Corporate Network Service ATM or Ethernet Provider ISP 1 Layer 2 Access IP Core PC with 802.11 Network W-LAN cards Radius 802.11 IPSec Client ISP 2 Wireless Software Access Point (Built in to Service Control W2000, XP) IPSec can be combined with Hotspot service to provide secure, encrypted traffic across access network This overcomes the security issues associated with WLAN networks 27 Quality of Service in WLANs Current WLAN devices mostly still operate with “best effort” data transmission - this has to change….. WLANs need to support voice over IP. Hence radio link QoS is essential Operators would like to apply traffic- based billing QoS support needed 28 14 Mapping IP QoS into WLAN Application Data IP Packet DS-field (or TOS-octet) Differentiated Packet (8 bits) RSVP Services Filters Ethernet Frame Ethernet priority (3 bits) Wireless link Wireless queues Real-time Best-effort VoIP Realtime queue data All the rest Best Effort WLAN QoS resembles 802.1p&Q approach: - Separate wireless link queues and priority scheduling - IP packet filters and DiffServ bits define the queue 29 Problems to Be Solved Terminal Mobility in the IP network WLAN solves LAN level mobility but... How to support mobility between IP sub- networks? Security Issues User authentication, encryption, billing etc End-to-end data security and remote access Configuration and Service discovery How to know essential network parameters How to locate services in a new network Wireless Quality of Service How to map IP QoS classes into radio link TCP behaviour is not optimal in wireless world30 15 The Desired Wireless Mobile IP Architecture Model 31 Layered View: IP Interworking Applications IP routing & QoS IP level authentication (AAA + PKI) IP (+ IP mobility + IP security + IP/GPRS billing) Seamless Interworking WLAN IPSec Fixed security WLAN security WWAN (3G) Ethernet Radio Access QoS IP 802.1p/Q Authentication mobility 32 16 What is needed now is … 3G and WLAN Integration / Interworking 3G and WLAN Management ….