Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

X- Wireless Network Security

Objectives Prerequisites
To be able to understand this lesson, students need notions on :
At the end of this lesson, students will be able to: • Wireless network architecture
• Understand and explain wireless network security architecture
• Describe wireless security protocols
• Understand and explain IEEE 802.11i operations and robust
security network
• Identify security differences between wired and wireless LAN
Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017
Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

Keywords

Wi-Fi, IEEE 802.11, IEEE 802.11i, WLAN

WAP, Discovery, Authentication
Key generation, distribution
Protected data transfer,
Connection termination, MAC protocol
data unit (MPDU), BSS, IBSS, ESS, AP, RSN

Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017

Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

Literature

Kizza, J. M. : Guide to Computer Network Security, Third Edition. Computer Communications and Networks.
Springer 2015
Stallings, W.: Cryptography and Network Security: Principles and Practice, Sixth Edition. Pearson, USA 2014

Further readings

Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017

Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

1. Concepts (1)
Wi-Fi (Wireless Fidelity) Alliance

IEEE 802.11 is a standard for wireless LANs. Interoperable standards compliant implementations are referred to as Wi-Fi.
• The first 802.11 standard to gain broad industry acceptance was 802.11b. Although 802.11b products are all based
on the same standard, there is always a concern whether products from different vendors will successfully interoperate
• The term used for certified 802.11b products is Wi-Fi. Wi-Fi certification has been extended to 802.11g products,. The
Wi-Fi Alliance has also developed a certification process for 802.11a products, called Wi-Fi5. The Wi-Fi Alliance is
concerned with a range of market areas for WLANs, including enterprise, home, and hot spots.

IEEE 802.11i specifies security standards for IEEE 802.11 LANs, including authentication, data integrity, data
confidentiality, and key management. Interoperable implementations are also referred to as Wi-Fi Protected Access (WPA)

IEEE 802.11 security standards, referred to as Wi-Fi Protected Access (WPA). The more recent: WPA2. It incorporates all
of the features of the IEEE 802.11i WLAN security specification.

◆ The Wireless Application Protocol (WAP) is a standard to provide mobile

users of wireless phones and other wireless terminals access to telephony
and information services, including the Internet and the Web.
Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017
Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

2. Concepts (2)

IEEE 802.11 Protocol Stack

General IEEE 802 MPDU MAC protocol data unit (MPDU) Format

Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017

Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

3. Architecture (1)
IEEE 802.11 Network Components and Architectural Model
In a BSS, client stations do not communicate directly with one
another. Rather, if one station in the BSS wants to
communicate with another station in the same BSS, the MAC
frame is first sent from the originating station to the AP and
then from the AP to the destination station.

Share wireless medium

Share wireless medium

When all the stations in the BSS are mobile stations that
communicate directly with one another (not using an AP), the
BSS is called an independent BSS (IBSS).
An IBSS is typically an ad hoc network. In an IBSS, the
stations all communicate directly, and no AP is involved.
IEEE 802.11 Extended Service Set
Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017
Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

4. Architecture (2)

Distribution of messages within a DS

The two services involved with the distribution of messages within a DS are distribution and integration.
Distribution is the primary service used by stations to exchange MPDUs when the MPDUs must
traverse the DS to get from a station in one BSS to a station in another BSS. For example, suppose a frame is to be sent from
station 2 (STA 2) to station 7 (STA 7) .The frame is sent from STA 2 to AP 1, which is the AP for this BSS. The AP gives the
frame to the DS, which has the job of directing the frame to the AP associated with STA 7 in the target BSS. AP 2 receives
the frame and forwards it to STA 7.
If the two stations that are communicating are within the same BSS, then the distribution service logically goes through the
single AP of that BSS.

The integration service enables transfer of data between a station on an IEEE 802.11 LAN and a station on an integrated
IEEE 802.x LAN. The term integrated refers to a wired LAN that is physically connected to the DS and whose stations may be
logically connected to an IEEE 802.11 LAN via the integration service. The integration service takes care of any address
translation and media conversion logic required for the exchange of data.

Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017

Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

5. Architecture (3)
Association-related services

• The primary purpose of the MAC layer is to transfer MSDUs between MAC entities; this purpose is fulfilled by the
distribution service
• Before the distribution service can deliver data to or accept data from a station, that station must be associated.
• Some notions to be known: Three transition types, based on mobility:
• No transition: A station of this type is either stationary or moves only within the direct communication range of the
communicating stations of a single BSS
• BSS transition: This is defined as a station movement from one BSS to another BSS within the same ESS. In this case,
delivery of data to the station requires that the addressing capability be able to recognize the new location of the
station.
• ESS transition: This is defined as a station movement from a BSS in one ESS to a BSS within another ESS. This case is
supported only in the sense that the station can move. Maintenance of upper-layer connections supported by 802.11
cannot be guaranteed. In fact, disruption of service is likely to occur.

To deliver a message within a DS, the distribution service needs to know where the destination station is located.
Specifically, the DS needs to know the identity of the AP to which the message should be delivered in order for that
message to reach the destination station. To meet this requirement, a station must maintain an association with the AP
within its current BSS.

Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017

Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

6. Architecture (4)

Association-related services

Three services relate to this requirement:

Association: Establishes an initial association between a station and an AP. Before a station can transmit or receive frames
on a wireless LAN, its identity and address must be known. For this purpose, a station must establish an association with an
AP within a particular BSS. The AP can then communicate this information to other APs within the ESS to facilitate routing
and delivery of addressed frames.

Reassociation: Enables an established association to be transferred from one AP to another, allowing a mobile station to
move from one BSS to another.

Disassociation: A notification from either a station or an AP that an existing association is terminated. A station should give
this notification before leaving an ESS or shutting down. However, the MAC management facility protects itself against
stations that disappear without notification.

Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017

Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

7. Wired security vs. Wireless LAN security

There are two characteristics of a wired LAN that are not inherent in a wireless LAN.

1. In order to transmit over a wired LAN, a station must be physically connected to the LAN. On the other hand,
with a wireless LAN, any station within radio range of the other devices on the LAN can transmit. In a sense,
there is a form of authentication with a wired LAN in that it requires some positive and presumably observable
action to connect a station to a wired LAN.
2. Similarly, in order to receive a transmission from a station that is part of a wired LAN, the receiving station also
must be attached to the wired LAN. On the other hand, with a wireless LAN, any station within radio range can
receive. Thus, a wired LAN provides a degree of privacy, limiting reception of data to stations connected to the
LAN.

These differences between wired and wireless LANs suggest the increased need for robust security services and
mechanisms for wireless LANs

• The original 802.11 specification included a set of security features for privacy and authentication that were quite
weak. For privacy, 802.11 defined the Wired Equivalent Privacy (WEP) algorithm.
• Wi-Fi Alliance promulgated Wi-Fi Protected Access (WPA) as a Wi-Fi standard
• The final form of the 802.11i standard is referred to as Robust Security Network (RSN). The Wi-Fi Alliance certifies
vendors in compliance with the full 802.11i specification under the WPA2 program
Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017
Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

8. 802.11i Robust Security Network

Authentication: A protocol is used to define an exchange between a user and an AS that provides mutual
authentication and generates temporary keys to be used between the client and the AP over the wireless link.
Access control: This function enforces the use of the authentication function, routes the messages properly, and
facilitates key exchange. It can work with a variety of authentication protocols
Privacy with message integrity: MAC-level data (e.g., an LLC PDU) are encrypted along with a message integrity
code that ensures that the data have not been altered.

CBC-MAC = Cipher Block Block Chaining Message Authentication Code (MAC)

CCM = Counter Mode with Cipher Block Chaining Message Authentication Code
CCMP = Counter Mode with Cipher Block Chaining MAC Protocol
TKIP = Temporal Key Integrity Protocol

Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017

Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

9. IEEE 802.11i Phases of Operations (1)

The operation of an IEEE 802.11i RSN can be broken down into five distinct phases of operation.
1. Two wireless stations in the same BSS communicating via the access point (AP) for that BSS.
2. Two wireless stations (STAs) in the same ad hoc IBSS communicating directly with each other.
3. Two wireless stations in different BSSs communicating via their respective Aps across a distribution system.
4. A wireless station communicating with an end station on a wired network via its AP and the distribution system.

IEEE 802.11i security is concerned only with secure communication between the STA and its AP

Case 1: secure communication is assured if each STA establishes secure communications with the AP
Case 2: similar, with the AP functionality residing in the STA
Case 3: security is not provided across the distribution system at the level of IEEE 802.11, but only within each BSS.
End to- end security (if required) must be provided at a higher layer
Case 4: Similarly, security is only provided between the STA and its AP.

Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017

Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

10. IEEE 802.11i Phases of Operations (2)

AS: Authentication Server

STA: Wireless Stations

Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017

Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

11. IEEE 802.11i Phases of Operations (3)

Discovery: An AP uses messages called Beacons and Probe Responses to advertise its IEEE 802.11i security policy. The
STA uses these to identify an AP for a WLAN with which it wishes to communicate. The STA associates with the AP,
which it uses to select the cipher suite and authentication mechanism when the Beacons and Probe Responses present a
choice.

Authentication: During this phase, the STA and AS prove their identities to each other. The AP blocks non-authentication
traffic between the STA and AS until the authentication transaction is successful. The AP does not participate in the
authentication transaction other than forwarding traffic between the STA and AS.

Key generation and distribution: The AP and the STA perform several operations that cause cryptographic keys to be
generated and placed on the AP and the STA. Frames are exchanged between the AP and STA only.

Protected data transfer: Frames are exchanged between the STA and the end station through the AP. As denoted by the
shading and the encryption module icon, secure data transfer occurs between the STA and the AP only; security is not
provided end-to-end.
Connection termination: The AP and STA exchange frames. During this phase, the secure connection is torn down and
the connection is restored to the original state.

Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017

Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

12. Exercises (1)

1 In IEEE 802.11, open system authentication simply consists of two communications. An authentication is requested
by the client, which contains the station ID (typically the MAC address). This is followed by an authentication
response from the AP/router containing a success or failure message.
An example of when a failure may occur is if the client’s MAC address is explicitly excluded in the AP/router
configuration.
a. What are the benefits of this authentication scheme?
b. What are the security vulnerabilities of this authentication scheme?

2 Prior to the introduction of IEEE 802.11i, the security scheme for IEEE 802.11 was Wired Equivalent Privacy
(WEP). WEP assumed all devices in the network share a secret key. The purpose of the authentication scenario is for
the STA to prove that it possesses the secret key. Authentication proceeds
as shown in Figure in the new slide. The STA sends a message to the AP requesting authentication. The AP issues a
challenge, which is a sequence of 128 random bytes sent as plaintext. The STA encrypts the challenge with the
shared key and returns it to the AP. The AP decrypts the incoming value and compares it to the challenge that it sent.
If there is a match, the AP confirms that authentication has succeeded.

Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017

Université de Ngaoundéré - Faculté des Sciences Département de Mathématiques et Informatique

13. Exercises (2)

WEP Authentication

a. What are the benefits of this authentication scheme?

b. This authentication scheme is incomplete. What is missing and why is this important?
Hint: The addition of one or two messages would fix the problem.
c. What is a cryptographic weakness of this scheme?

Cycle: Master – Semestre 2 - SLED Academic Year 2016/2017