VPN Wireless Security at Penn State Rich Cropp Senior Systems Engineer Information Technology Services The Pennsylvania State University © 2003. All rights.

Slides:

Advertisements

Similar presentations

Encrypting Wireless Data with VPN Techniques

Advertisements

1 Chapter 2: Networking Protocol Design Designs That Include TCP/IP Essential TCP/IP Design Concepts TCP/IP Data Protection TCP/IP Optimization.

Securing Remote PC Access to UNIX/Linux Hosts with VPN or SSH Charles T. Moetului WRQ, Inc. (206)

Setting Up a Virtual Private Network Chapter 9. Learning Objectives Understand the components and essential operations of virtual private networks (VPNs)

IPsec: Internet Protocol Security Chong, Luon, Prins, Trotter.

無線區域網路安全 Wireless LAN Security. 2 Outline  Wireless LAN – b  Security Mechanisms in b  Security Problems in b  Solutions for b.

Virtual Private Networks and IPSec

CN1260 Client Operating System Kemtis Kunanuraksapong MSIS with Distinction MCT, MCITP, MCTS, MCDST, MCP, A+

VIRTUAL PRIVATE NETWORKS (VPN). GROUP MEMBERS ERVAND AKOPYAN ORLANDO CANTON JR. JUAN DAVID OROZCO.

Hands-On Microsoft Windows Server 2003 Administration Chapter 11 Administering Remote Access Services.

1 IP VPN Nikolay Scarbnik. 2 Agenda Introduction………………………………………………………….3 VPN concept definition……………………………………………..4 VPN advantages……………...…………………………………….5.

VPN – Technologies and Solutions CS158B Network Management April 11, 2005 Alvin Tsang Eyob Solomon Wayne Tsui.

VPN – Virtual Private Networking. VPN A Virtual Private Network (VPN) connects the components of one network over another network. VPNs accomplish this.

Virtual Private Networks

Network Security Philadelphia UniversitylAhmad Al-Ghoul Module 12 Module 12 Virtual Private Networks  MModified by :Ahmad Al Ghoul  PPhiladelphia.

Faten Yahya Ismael.  It is technology creates a network that is physically public, but virtually it’s private.  A virtual private network (VPN) is a.

VPN TUNNELING PROTOCOLS PPTP, L2TP, L2TP/IPsec Ashkan Yousefpour Amirkabir University of Technology.

© 2007 Cisco Systems, Inc. All rights reserved.ISCW-Mod3_L7 1 Network Security 2 Module 6 – Configure Remote Access VPN.

1 Microsoft Windows NT 4.0 Authentication Protocols Password Authentication Protocol (PAP) Challenge Handshake Authentication Protocol (CHAP) Microsoft.

Virtual Private Networks (Tunnels). When Are VPN Tunnels Used? VPN with PPTP tunnel Used if: All routers support VPN tunnels You are using MS-CHAP or.

Virtual Private Networks Alberto Pace. IT/IS Technical Meeting – January 2002 What is a VPN ? u A technology that allows to send confidential data securely.

Microsoft Windows Server 2003 TCP/IP Protocols and Services Technical Reference Slide: 1 Lesson 23 Virtual Private Networks (VPNs)

SYSTEM ADMINISTRATION Chapter 13 Security Protocols.

Virtual Private Network (VPN) SCSC 455. VPN A virtual private network that is established over, in general, the Internet – It is virtual because it exists.

What Is Needed to Build a VPN? An existing network with servers and workstations Connection to the Internet VPN gateways (i.e., routers, PIX, ASA, VPN.

12-Sep-15 Virtual Private Network. Why the need To transmit files securely without disclosing sensitive information to others in the Internet.

Chapter 13 – Network Security

Remote Access Chapter 4. Learning Objectives Understand implications of IEEE 802.1x and how it is used Understand VPN technology and its uses for securing.

Remote Access Chapter 4. Learning Objectives Understand implications of IEEE 802.1x and how it is used Understand VPN technology and its uses for securing.

VPN Protocol What is a VPN? A VPN is A network that uses Internet or other network service to transmit data. A VPN includes authentication and.

11 SECURING COMMUNICATIONS Chapter 7. Chapter 7: SECURING COMMUNICATIONS2 CHAPTER OBJECTIVES  Explain how to secure remote connections.  Describe how.

11.59 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 11: Introducing WINS, DNS,

Wireless Security Beyond WEP. Wireless Security Privacy Authorization (access control) Data Integrity (checksum, anti-tampering)

1 Chapter 8 Copyright 2003 Prentice-Hall Cryptographic Systems: SSL/TLS, VPNs, and Kerberos.

Module 8: Designing Network Access Solutions. Module Overview Securing and Controlling Network Access Designing Remote Access Services Designing RADIUS.

1 Chapter 12: VPN Connectivity in Remote Access Designs Designs That Include VPN Remote Access Essential VPN Remote Access Design Concepts Data Protection.

VIRTUAL PRIVATE NETWORK By: Tammy Be Khoa Kieu Stephen Tran Michael Tse.

Abdullah Alshalan Garrett Drown Team 3 CSE591: Virtualization and Cloud Computing.

11.59 © 2004 Pearson Education, Inc. Exam Managing and Maintaining a Microsoft® Windows® Server 2003 Environment Lesson 11: Introducing WINS, DNS,

Examining Network Protocols. Overview Introduction to Protocols Protocols and Data Transmissions Common Protocols Other Communication Protocols Remote.

Hands-On Microsoft Windows Server Introduction to Remote Access Routing and Remote Access Services (RRAS) –Enable routing and remote access through.

WEP Protocol Weaknesses and Vulnerabilities

Page 1 TCP/IP Networking and Remote Access Lecture 9 Hassan Shuja 11/23/2004.

Network access security methods Unit objective Explain the methods of ensuring network access security Explain methods of user authentication.

Generic Routing Encapsulation GRE  GRE is an OSI Layer 3 tunneling protocol: Encapsulates a wide variety of protocol packet types inside.

Module 4 Quiz. 1. Which of the following statements about Network Address Translation (NAT) are true? Each correct answer represents a complete solution.

Module 8: Designing Security for Authentication. Overview Creating a Security Plan for Authentication Creating a Design for Security of Authentication.

IP Security: Security Across the Protocol Stack. IP Security There are some application specific security mechanisms –eg. S/MIME, PGP, Kerberos, SSL/HTTPS.

Virtual Private Network. ATHENA Main Function of VPN  Privacy  Authenticating  Data Integrity  Antireplay.

Wireless Security Rick Anderson Pat Demko. Wireless Medium Open medium Broadcast in every direction Anyone within range can listen in No Privacy Weak.

Securing Data Transmission and Authentication. Securing Traffic with IPSec IPSec allows us to protect our network from within IPSec secures the IP protocol.

Virtual Private Network Chapter 4. Lecturer : Trần Thị Ngọc Hoa2 Objectives  VPN Overview  Tunneling Protocol  Deployment models  Lab Demo.

Wireless security Wi–Fi (802.11) Security

Virtual Private Networks Ed Wagner CS Overview Introduction Types of VPNs Encrypting and Tunneling Pro/Cons the VPNs Conclusion.

1 Objectives Wireless Access IPSec Discuss Network Access Protection Install Network Access Protection.

K. Salah1 Security Protocols in the Internet IPSec.

Virtuelne Privatne Mreže 1 Dr Milan Marković. VPN implementations  In the following sections we will discuss these popular VPN implementation methods,

Copyright © 2006 Heathkit Company, Inc. All Rights Reserved Introduction to Networking Technologies Wireless Security.

Virtual Private Networks

Virtual Private Networks and IPSec

VPNs and IPSec Review VPN concepts Encryption IPSec Lab.

Virtual Private Networks

Virtual Private Network (VPN)

Chapter 18 IP Security  IP Security (IPSec)

Examining Network Protocols

Virtual Private Network (VPN)

VPNs and IPSec Review VPN concepts Encryption IPSec Lab.

Virtual Private Networks

Virtual Private Networks (VPN)

Virtual Private Network zswu

Presentation transcript:

VPN Wireless Security at Penn State Rich Cropp Senior Systems Engineer Information Technology Services The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, 2003.

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Agenda ITS Wireless Service ITS Wireless Service What is a VPN? What is a VPN? VPN Tunneling Protocols VPN Tunneling Protocols What is next for the ITS WLAN Service? What is next for the ITS WLAN Service?

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Design Requirements for the ITS Wireless LAN Service Standards Based Standards Based Adhere to PSU Security Policy (AD20) Adhere to PSU Security Policy (AD20)AD20 Support Windows ≥ 98 / Linux / Mac OS Support Windows ≥ 98 / Linux / Mac OS Encrypt user data and passwords Encrypt user data and passwords Authenticate users with Penn State Access Account Authenticate users with Penn State Access AccountPenn State Access AccountPenn State Access Account Assignment of IP address via DHCP Assignment of IP address via DHCP Log authenticated users IP address assignment Log authenticated users IP address assignment Roaming within a building Roaming within a building

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Eliminated Solutions Any b AP using WEP and MAC Filtering Any b AP using WEP and MAC Filtering Flawed WEP algorithmFlawed WEP algorithmFlawed WEP algorithmFlawed WEP algorithm Not authenticating userNot authenticating user Cisco Aironet 350 AP with LEAP Cisco Aironet 350 AP with LEAP Required Cisco client cardRequired Cisco client card Required Cisco ACS RADIUS ServerRequired Cisco ACS RADIUS Server LEAP vulnerable to dictionary attackLEAP vulnerable to dictionary attackLEAP vulnerable to dictionary attackLEAP vulnerable to dictionary attack Orinoco AS2000 Orinoco AS2000 Required Orinoco client cardRequired Orinoco client card No Linux clientNo Linux client

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Solution: Firewall and VPN Router provides firewall function (ACLs) Router provides firewall function (ACLs) Firewall prevents unauthenticated access Firewall prevents unauthenticated access Firewall only allows traffic to: Firewall only allows traffic to: DHCP ServerDHCP Server DNS ServersDNS Servers VPN ConcentratorVPN Concentrator VPN authenticates users VPN authenticates users VPN encrypts observable wireless traffic VPN encrypts observable wireless traffic

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, ITS Wireless LAN Service

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Agenda ITS Wireless Service ITS Wireless Service What is a VPN? What is a VPN? VPN Tunneling Protocols VPN Tunneling Protocols What is next for the ITS WLAN Service? What is next for the ITS WLAN Service?

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, What is a VPN? A Virtual Private Network (VPN) is a private network that makes use of the public telecommunication infrastructure, maintaining privacy through the use of a tunneling protocol and security procedures. - VPN Consortium - VPN ConsortiumVPN ConsortiumVPN Consortium

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, VPN Example #1 Mobile users accessing company resources from remote locations

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, VPN Example #2 Interconnect LANs over a shared network infrastructure

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Agenda ITS Wireless Service ITS Wireless Service What is a VPN? What is a VPN? VPN Tunneling Protocols VPN Tunneling Protocols What is next for the ITS WLAN Service? What is next for the ITS WLAN Service?

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Point-to-Point Tunneling Protocol (PPTP) Developed by 3Com, Ascend, ECI Telematics, USR, and Microsoft Developed by 3Com, Ascend, ECI Telematics, USR, and Microsoft PPTP client is part of most modern Microsoft Windows Operating Systems PPTP client is part of most modern Microsoft Windows Operating Systems RFC 2637 RFC 2637 RFC 2637 RFC 2637 Layer 2 Layer 2 Encapsulates PPP session using Generic Routing Encapsulation (GRE) Encapsulates PPP session using Generic Routing Encapsulation (GRE) Supports non-IP protocols (IPX, NetBEUI, Appletalk, etc.) Supports non-IP protocols (IPX, NetBEUI, Appletalk, etc.) Uses any PPP authentication schemes (PAP, CHAP, MS-CHAP, etc.) Uses any PPP authentication schemes (PAP, CHAP, MS-CHAP, etc.) Encryption via Microsoft Point-to-Point Encryption (MPPE) Encryption via Microsoft Point-to-Point Encryption (MPPE) MPPE uses RC4 algorithm with 40 or 128 bit keys MPPE uses RC4 algorithm with 40 or 128 bit keys

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Layer 2 Tunneling Protocol (L2TP) Combined: Combined: Microsoft PPTPMicrosoft PPTP Cisco’s Layer 2 Forwarding (L2F)Cisco’s Layer 2 Forwarding (L2F) RFC 2661 RFC 2661 RFC 2661 RFC 2661 Supports WAN technologies (Frame Relay, ATM, X.25, etc.) Supports WAN technologies (Frame Relay, ATM, X.25, etc.) Encryption via MPPE or IPSec Encryption via MPPE or IPSec

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, IP Security (IPSec) RFC 2401 – RFC 2411 RFC 2401 – RFC 2411 Layer 3 Layer 3 Peers negotiate Security Association (SA) using Internet Security Association and Key Management Protocol (ISAKMP) Peers negotiate Security Association (SA) using Internet Security Association and Key Management Protocol (ISAKMP) Encryption AlgorithmEncryption Algorithm Hashing AlgorithmHashing Algorithm AuthenticationAuthentication Lifetime of SALifetime of SA Internet Key Exchange (IKE) provides authenticated keying material for ISAKMP Internet Key Exchange (IKE) provides authenticated keying material for ISAKMP IKE implements part of the Oakley Key Determination Protocol and part of the SKEME Protocol IKE implements part of the Oakley Key Determination Protocol and part of the SKEME Protocol Two Modes: Two Modes: Transport: Packet payload encryptedTransport: Packet payload encrypted Tunnel: Entire packet including headersTunnel: Entire packet including headers

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Which one to use? If security primary concern: IPSec If security primary concern: IPSec  Resistant to denial of service, man in the middle, dictionary, and spoofing attacks Something quick and simple: PPTP Something quick and simple: PPTP  Part of the Microsoft Windows Operating System If underlying protocol is other than IP: L2TP If underlying protocol is other than IP: L2TP  Supports IP, X.25, Frame Relay, and ATM

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Agenda ITS Wireless Service ITS Wireless Service What is a VPN? What is a VPN? VPN Tunneling Protocols VPN Tunneling Protocols What is next for the ITS WLAN Service? What is next for the ITS WLAN Service?

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, VPN solution for wireless is not perfect: ComplexComplex Additional client to installAdditional client to install Another network deviceAnother network device Does not scale wellDoes not scale well Bad network designBad network design Adds latencyAdds latency

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Wish List Remove VPN Concentrator Remove VPN Concentrator Remove Firewall (Router ACLs) Remove Firewall (Router ACLs) Authenticate users at access point Authenticate users at access point Better encryption between AP and wireless device Better encryption between AP and wireless device IEEE i availability IEEE i availability

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, ITS Wireless LAN Service

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Future ITS Wireless LAN Service?

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Wi-Fi Protected AccessWi-Fi Protected Access (WPA) Wi-Fi Protected Access 802.1x Authentication 802.1x Authentication AP filters client traffic until user authenticatesAP filters client traffic until user authenticates Username and password authenticationUsername and password authentication Temporal Key Integrity Protocol (TKIP) Temporal Key Integrity Protocol (TKIP) Message Integrity Check (MIC)Message Integrity Check (MIC) MIC adds sequence number to the wireless frameMIC adds sequence number to the wireless frame Mitigates frame tampering / bit flipping vulnerabilityMitigates frame tampering / bit flipping vulnerability Per-packet keyingPer-packet keying Mitigates WEP key derivation vulnerabilityMitigates WEP key derivation vulnerability

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, IEEE i (WPA2) Secure Ad-Hoc Mode Secure Ad-Hoc Mode Secure fast handoff (< 150ms) Secure fast handoff (< 150ms) Secure de-authentication and disassociation Secure de-authentication and disassociation Enhanced encryption protocol (AES-CCMP) Enhanced encryption protocol (AES-CCMP)

The Pennsylvania State University © All rights reserved. Academic Services and Emerging Technologies (ASET), a unit of Information Technology Services (ITS) November 10, Questions?