..................................................................................................................................... ii Preface .......................................................................................................................................iii Abbreviation............................................................................................................................... x Thesis definition......................................................................................................................... 1 1.1 Problem introduction and background ....................................................................... 2 1.2 Concepts and definitions ............................................................................................ 3 1.3 Security requirements................................................................................................. 5 1.4 Problem area............................................................................................................... 6 1.4.1 Security problem scenarios ................................................................................ 7 1.4.1.1 Case one ......................................................................................................... 7 1.4.1.2 Case two ......................................................................................................... 8 1.4.2 Particular sub problems.................................................................................... 10 1.5 Methods and thesis work.......................................................................................... 11 1.6 Delimitations and presumptions............................................................................... 11 1.7 Requirements............................................................................................................ 12 1.8 Motivation and thesis outcome ................................................................................ 12 1.9 Project outline .......................................................................................................... 13 2 Preliminaries and literature studies .................................................................................. 14 2.1 The wireless architectural model.............................................................................. 14 2.2 Physical characteristics ............................................................................................ 15 2.3 IEEE 802.11 protocol ............................................................................................... 17 2.3.1 IEEE 802.11 frame structure ............................................................................ 19 2.3.2 IEEE 802.11 frame types ................................................................................. 20 2.3.3 The 802.11 state machine and the association process .................................... 21 2.4 WLAN threats and security challenges .................................................................... 24 2.4.1 Threat levels and definitions ............................................................................ 24 2.4.2 Wireless threat aspects ..................................................................................... 24 2.4.2.1 Eavesdropping.............................................................................................. 24 2.4.2.2 Monitoring and traffic analysis .................................................................... 25 2.4.2.3 Brute force attack ......................................................................................... 25 2.4.2.4 Man-in-the-Middle attack ............................................................................ 25 2.4.2.5 Message modification and replay attacks..................................................... 25 2.4.2.6 Spoofing and masquerading attacks ............................................................. 26 2.4.2.7 Session hijacking attack ............................................................................... 26 2.4.2.8 Rogue access points, rough clients and phishing attacks ............................. 26 Agder University College Faculty of Engineering and Science v 2.4.2.9 Denial of Service (DOS) and flooding attacks............................................. 27 2.4.2.10 RF Jamming attacks ................................................................................. 27 2.5 Overview of IEEE 802.11 WLAN security ............................................................. 28 2.5.1 Access Control ................................................................................................. 28 2.5.2 Confidentiality and integrity ............................................................................ 30 2.5.2.1 Robust Security Networks (RSN) ................................................................ 31 2.5.2.2 Cryptographic key hierarchies, generation and key management................ 34 2.5.3 Availability....................................................................................................... 37 2.5.3.1 Wireless environmental control using wireless sensor devices ................... 38 2.5.4 Summary of WLAN security challenges ......................................................... 40 2.6 VPN/IPsec for network-layer security ..................................................................... 41 2.6.1 IPsec in wireless networks ............................................................................... 41 2.6.1.1 IPsec ESP ..................................................................................................... 41 2.6.2 Virtual Private Network (VPN)........................................................................ 42 3 Access control based on IEEE 802.1X............................................................................. 43 3.1 Access control operations......................................................................................... 43 3.1.1 The discovery phase ......................................................................................... 45 3.1.2 The authentication phase .................................................................................. 48 3.1.2.1 IEEE 802.1X framework and concepts ........................................................ 49 3.2 Extensible Authentication Protocol (EAP)............................................................... 52 3.2.1 EAP methods.................................................................................................... 53 3.2.2 EAP requirements ............................................................................................ 54 3.2.2.1 EAP claim list [44, 42] ................................................................................. 55 3.2.3 EAP methods based on RFC 3748 ................................................................... 57 3.2.3.1 EAP-TLS...................................................................................................... 58 3.2.3.2 EAP-TTLS ................................................................................................... 60 3.2.3.3 Protected EAP (PEAP)................................................................................. 61 3.2.3.4 EAP-FAST ................................................................................................... 61 3.2.4 EAP methods evaluation .................................................................................. 62 3.3 Access control conclusion........................................................................................ 64 3.3.1 Wireless access control requirements .............................................................. 64 4 Confidentiality and integrity based on IEEE 802.11i ...................................................... 71 4.1 RSN confidentiality, authenticity and integrity protocols........................................ 71 4.1.1 CCMP............................................................................................................... 71 4.1.1.1 CCM encryption process .............................................................................. 72 4.1.1.2 CCM decryption process .............................................................................. 74 4.2 CCMP, key establishment and management............................................................ 75 Agder University College Faculty of Engineering and Science vi 4.2.1 The 4 way-handshake....................................................................................... 76 4.2.2 Secure connection termination ......................................................................... 78 4.3 Confidentiality, authenticity and integrity conclusion ............................................. 79 4.3.1 Further work ..................................................................................................... 81 5 Availability – control, detection and protection............................................................... 82 5.1 Availability aspects .................................................................................................. 82 5.1.1 Observing the wireless network and the environment ..................................... 83 5.1.1.1 Types of wireless sensor and detection systems .......................................... 84 5.1.2 A wireless distributed monitor architecture ..................................................... 87 5.1.3 Wireless monitor system advantages and capabilities ..................................... 89 5.1.4 Wireless monitor systems drawbacks and infirmities ...................................... 94 5.2 Monitor system and active responses....................................................................... 96 5.2.1 A monitor protection system and architectural issues...................................... 96 5.2.2 Fake AP and WLAN honeypot network ..............