Secure WNM Requirements Month Year May 2005 May 2005 Secure WNM Requirements Authors: Date:2005-05-12 Notice: This document has been prepared to assist IEEE 802.11. It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein. Release: The contributor grants a free, irrevocable license to the IEEE to incorporate material contained in this contribution, and any modifications thereof, in the creation of an IEEE Standards publication; to copyright in the IEEE’s name any IEEE Standards publication even though it may include portions of this contribution; and at the IEEE’s sole discretion to permit others to reproduce in whole or in part the resulting IEEE Standards publication. The contributor also acknowledges and accepts that this contribution may be made public by IEEE 802.11. Patent Policy and Procedures: The contributor is familiar with the IEEE 802 Patent Policy and Procedures <http:// ieee802.org/guides/bylaws/sb-bylaws.pdf>, including the statement "IEEE standards may include the known use of patent(s), including patent applications, provided the IEEE receives assurance from the patent holder or applicant with respect to patents essential for compliance with both mandatory and optional portions of the standard." Early disclosure to the Working Group of patent information that might be relevant to the standard is essential to reduce the possibility for delays in the development process and increase the likelihood that the draft publication will be approved for publication. Please notify the Chair <stuart.kerry@philips.com> as early as possible, in written or electronic form, if patented technology (or technology under patent application) might be incorporated into a draft standard being developed within the IEEE 802.11 Working Group. If you have questions, contact the IEEE Patent Committee Administrator at <patcom@ieee.org>. Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Month Year May 2005 May 2005 Abstract This document provides threat analysis and suggests protection service requirements for Wireless Network Management. Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Agenda Possible Service Categories for WNM Threat Analysis for WNM Month Year May 2005 May 2005 Agenda Possible Service Categories for WNM Threat Analysis for WNM Requirements for TGw Requirements for TGv Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Setting MIB parameters over the air has security implications Month Year May 2005 May 2005 Purpose of 802.11v (from PAR) Enables management of attached stations in a centralized or in a distributed fashion (e.g. monitoring, configuring, and updating) through a layer 2 mechanism. Setting MIB parameters over the air has security implications Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Month Year May 2005 May 2005 Possible Service Categories for 802.11v (doc. : 0076r00 by John Klein, et al) Configuration Management Performance and Resource Management Operations Management Fault and Security Management Accounting Management Location Services, etc. (refereed to doc.:0076r00 by John Klein, et al) Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Threats to Wireless Network Mangement Month Year May 2005 May 2005 Threats to Wireless Network Mangement Forgery Attack Masquerade Delay Attack Disclosure Denial of Service Traffic Analysis Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Month Year May 2005 May 2005 Forgery Attack An unauthorized entity could set or change any unprotected management parameter, including those related to configuration, operations, and accounting WNM message could be reordered or replayed to effect unauthorized management operations For example, an unauthorized entity could modify load balancing message to direct the STA to another AP Requirement: Need Forgery Protection - TGw Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Masquerade Requirement: Month Year May 2005 May 2005 Masquerade An unauthorized entity may attempt some management operations by assuming the identity of an authorized entity For example, an unauthorized AP, who is not authorized for STA’s firmware update, may attempt to update STA’s firmware Requirement: Need to provide policy advertisement, discovery, and negotiation to agree upon which WNM messages the peer is authorized to send – TGv Need to define its own Access Control mechanism – TGv Need Authentication and Authorization Protection – TGw STA and AP Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Month Year May 2005 May 2005 Delay Attack WNM management message could be delayed to effect invalid management operations. Delay attack is similar to a replay attack, but because of man-in-the-middle nodes, hidden nodes, power save mode, etc., the frames are received in sequence, so do not appear as retries In normal replay attack, frames are received out of sequence or more than one time For example, a delayed Load Balancing message may not be valid any more. Suggested Requirement: Need Delay Protection – TGw Need Timeliness for management message - TGv Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Disclosure Requirement:  Need Confidentiality Protection - TGw Month Year May 2005 May 2005 Disclosure An entity could observe data exchanged between an AP and a STA and thereby learn the values of managed objects and learn of notify-able events For example, the observation of a set of location information and management (for Location Service) would enable an attacker to learn asset tracking Because of privacy concerns, Manager (AP) and Agent (STA) may not want a third party to know their accounting parameter setting (for Accounting Management) WNM policy needs to be consistent with SNMP v3 policy for confidentiality, because all WNM objects are in the SNMP MIB If SNMP policy requires confidentiality, then so does WNM. Requirement:  Need Confidentiality Protection - TGw Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Denial-of-service An attacker may prevent exchange between AP and STA Month Year May 2005 May 2005 Denial-of-service An attacker may prevent exchange between AP and STA Wireless Network Connection Failure Disruption of all type of exchanges Management message forgery can create novel denial-of-service attacks #1 and #2 are not new denial-of-service threats and can be implemented by PHY. Accordingly, the MAC cannot protect against them. #3 needs forgery protection - TGw Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Month Year May 2005 May 2005 Traffic Analysis An attacker may observe the general pattern of management traffic between AP and STA Algorithms to defeat traffic analysis fill the channel with random noise and pad all frames to the same length – decreases available bandwidth – not viable commercially. Wireless Network traffic patterns in WLANs based on commercial equipment are predictable, and therefore there is no significant advantage to protect against observing these traffic patterns. Protecting against traffic analysis destroys the value of a WLAN Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Suggested Requirements for TGw (summary) Month Year May 2005 May 2005 Suggested Requirements for TGw (summary) Authentication Protection Authorization Protection Forgery Protection Replay Protection Confidentiality Protection Delay Protection ? Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Suggested Requirements for TGv (1) Month Year May 2005 May 2005 Suggested Requirements for TGv (1) Requirement: Need to provide policy advertisement, discovery, and negotiation to agree upon which WNM messages the peer is authorized to send Require backward compatibility with pre-TGv STAs and APs Each STA or AP will have its own policy of whether to interpret WNM messages as commands, advice, or irrelevant 802.11 operates in unlicensed band, so no guarantee any message will be interpreted as a command Many 802.11 platforms are open and owned by some entity other than the network owner, so no guarantee they will respond to WNM messages as “commands” Cover Enterprise, Home, and Hotspot for usage scenarios Emily Qi, Intel Corporation Emily Qi, Intel Corporation

Suggested Requirements for TGv (2) Month Year May 2005 May 2005 Suggested Requirements for TGv (2) Requirement: Need Timeliness for managements message : The manager (sender) should dictate that a message must be received within a reasonable time window, to avoid delay attacks. The time window should be chosen to be as small as possible given the accuracy of the clocks involved and round-trip communication delays The receiver should conduct a timeliness check when message arrives Emily Qi, Intel Corporation Emily Qi, Intel Corporation

May 2005 Feedback? Emily Qi, Intel Corporation