By: Alex Feldman.  A mobile station is connected to the network wirelessly through another device.  In case of WiFi (IEEE 802.11) this would be an access.

Slides:

Advertisements

Similar presentations

RadSec – A better RADIUS protocol

Advertisements

Doc.: IEEE /1186r0 Submission October 2004 Aboba and HarkinsSlide 1 PEKM (Post-EAP Key Management Protocol) Bernard Aboba, Microsoft Dan Harkins,

Unlicensed Mobile Access (UMA) Dasun Weerasinghe School of Engineering and Mathematical Sciences City University London.

Socket Layer Security. In this Presentation: need for web security SSL/TLS transport layer security protocols HTTPS secure shell (SSH)

IEEE i IT443 Broadband Communications Philip MacCabe October 5, 2005

Topic 8: Secure communication in mobile devices. Choice of secure communication protocols, leveraging SSL for remote authentication and using HTTPS for.

CSE  Wired Equivalent Privacy (WEP) ◦ first security protocol defined in  Wi-Fi Protected Access (WPA) ◦ defined by Wi-Fi Alliance 

Understanding and Achieving Next-Generation Wireless Security Motorola, Inc James Mateicka.

Doc.: IEEE /275 Submission September 2000 David Halasz, Cisco Systems, Inc.Slide 1 IEEE 802.1X for IEEE David Halasz, Stuart Norman, Glen.

Raphael Frank 20 October 2007 Authentication & Intrusion Prevention for Multi-Link Wireless Networks.

TCP/IP Protocol Suite 1 Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display. Chapter 30 Internet Security.

802.1x EAP Authentication Protocols

An Initial Security Analysis of the IEEE 802.1x Standard Tsai Hsien Pang 2004/11/4.

Protected Extensible Authentication Protocol

Wireless LAN Security Framework Backend AAA Infrastructure RADIUS, TACACS+, LDAP, Kerberos TLSLEAPTTLSPEAPMD5 VPN EAP PPP x EAP API.

IEEE Wireless Local Area Networks (WLAN’s).

Chapter 5 Secure LAN Switching.  MAC Address Flooding Causing CAM Overflow and Subsequent DOS and Traffic Analysis Attacks.

Transport Layer Flow. Socket Connections UDP Segment Structure.

Master Thesis Proposal By Nirmala Bulusu Advisor – Dr. Edward Chow Implementation of Protected Extensible Protocol (PEAP) – An IEEE 802.1x wireless LAN.

Chapter 16 AAA. AAA Components  AAA server –Authenticates users accessing a device or network –Authorizes user to perform specific activities –Performs.

WPA2 By Winway Pang. Overview  What is WPA2?  Wi-Fi Protected Access 2  Introduced September 2004  Two Versions  Enterprise – Server Authentication.

By Alvin Tse.  FCC – Federal Communications Commission   IETF – Internet Engineering Task Force   IEEE –

Using RADIUS Within the Framework of the School Environment Charles Bolen Systems Engineer December 6, 2011.

1 © 2005 Cisco Systems, Inc. All rights reserved. 111 © 2004, Cisco Systems, Inc. All rights reserved.

EAP Overview (Extensible Authentication Protocol) Team Golmaal: Vaibhav Sharma Vineet Banga Manender Verma Lovejit Sandhu Abizar Attar.

Using RADIUS Within the Framework of the School Environment Ed Register Consultant April 6, 2011.

MCTS Guide to Microsoft Windows Server 2008 Network Infrastructure Configuration Chapter 9 Network Policy and Access Services in Windows Server 2008.

1 © 2005 Cisco Systems, Inc. All rights reserved. 111 © 2004, Cisco Systems, Inc. All rights reserved. CNIT 221 Security 1 ver.2 Module 7 City College.

Doc.: IEEE /1066r2 Submission July 2011 Robert Moskowitz, VerizonSlide 1 Link Setup Flow Date: Authors: NameCompanyAddressPhone .

Mobile and Wireless Communication Security By Jason Gratto.

Wireless security & privacy Authors: M. Borsc and H. Shinde Source: IEEE International Conference on Personal Wireless Communications 2005 (ICPWC 2005),

Wireless and Security CSCI 5857: Encoding and Encryption.

IEEE MEDIA INDEPENDENT HANDOVER DCN: srho

32.1 Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction.

BY MOHAMMED ALQAHTANI (802.11) Security. What is ? IEEE is a set of standards carrying out WLAN computer communication in frequency bands.

Behzad Akbari Spring 2012 (These slides are based on lecture slides by Lawrie Brown)

1 © 2005 Cisco Systems, Inc. All rights reserved. 111 © 2004, Cisco Systems, Inc. All rights reserved.

Doc.: IEEE /0039r0 Submission NameAffiliationsAddressPhone Robert Sun; Yunbo Li Edward Au; Phil Barber Junghoon Suh; Osama Aboul-Magd Huawei.

Shambhu Upadhyaya Security –Upper Layer Authentication Shambhu Upadhyaya Wireless Network Security CSE 566 (Lecture 10)

Cryptography and Network Security (SSL)

Tunneling and Securing TCP Services Nathan Green.

11 SECURING NETWORK COMMUNICATION Chapter 9. Chapter 9: SECURING NETWORK COMMUNICATION2 OVERVIEW  List the major threats to network communications. 

輔大資工所在職研一報告人：林煥銘學號： Public Access Mobility LAN: Extending The Wireless Internet into The LAN Environment Jun Li, Stephen B. Weinstein, Junbiao.

A policy-based per-flow mobility management system design

IEEE i Aniss Zakaria Survey Fall 2004 Friday, Dec 3, 2004

Doc.: IEEE /1062r0 Submission September 2004 F. Bersani, France Telecom R&DSlide 1 Dominos, bonds and watches: discussion of some security requirements.

EAP Keying Framework Draft-aboba-pppext-key-problem-06.txt EAP WG IETF 56 San Francisco, CA Bernard Aboba.

IEEE MEDIA INDEPENDENT HANDOVER Title: Use Cases, Security Study Group Date Submitted: Nov 13 th, 2007 Presented at: IEEE Security SG Authors.

Doc.: IEEE /008r0 Submission January 2003 N. Cam-Winget, D. Smith, K. AmannSlide 1 Proposed new AKM for Fast Roaming Nancy Cam-Winget, Cisco Systems.

Web Security Web now widely used by business, government, individuals but Internet & Web are vulnerable have a variety of threats – integrity – confidentiality.

Wireless security Wi–Fi (802.11) Security

1 Objectives Wireless Access IPSec Discuss Network Access Protection Install Network Access Protection.

Network Access Control

Wireless Network Security CSIS 5857: Encoding and Encryption.

 Internet has become an integral part of our lives and our dependence on internet is increasing day by day. We used to access internet through Dial-up.

Doc.: IEEE /657r0 Submission August 2003 N. Cam-WingetSlide 1 TGi Draft 5.0 Comments Nancy Cam-Winget, Cisco Systems Inc.

KAIS T Comparative studies on authentication and key exchange methods for wireless LAN Jun Lei, Xiaoming Fu, Dieter Hogrefe, Jianrong Tan Computers.

This courseware is copyrighted © 2016 gtslearning. No part of this courseware or any training material supplied by gtslearning International Limited to.

Lecture 6 (Chapter 16,17,18) Network and Internet Security Prepared by Dr. Lamiaa M. Elshenawy 1.

EECS  Wired Equivalent Privacy (WEP) ◦ first security protocol defined in  Wi-Fi Protected Access (WPA) ◦ defined by Wi-Fi Alliance 

Introduction to Port-Based Network Access Control EAP, 802.1X, and RADIUS Anthony Critelli Introduction to Port-Based Network Access Control.

KAPLAN SCHOOL OF INFORMATION SYSTEMS AND TECHNOLOGY IT375 Window Enterprise Administration Course Name – IT Introduction to Network Security Instructor.

Port Based Network Access Control

Authentication and handoff protocols for wireless mesh networks

M. Kassab, A. Belghith, J. Bonnin, S. Sassi

SECURING WIRELESS LANS WITH CERTIFICATE SERVICES

Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls

Authentication and handoff protocols for wireless mesh networks

IEEE MEDIA INDEPENDENT HANDOVER DCN: sec

IEEE MEDIA INDEPENDENT HANDOVER DCN: sec

Presentation transcript:

By: Alex Feldman

 A mobile station is connected to the network wirelessly through another device.  In case of WiFi (IEEE ) this would be an access point.  In case of WiMax (IEEE ) it is a base station.

 The mobile station may need to change its connection point to the network.  The connection point “Hands Over” the connection to the new point.  It has to be secure  It has to be fast  It has to be standardized

 Supplicant (Sta)– the station entering the network to be authenticated.  Authenticator (Au) – the access point directly connected to the station, and acting as a proxy to the authentication server.  Authentication Server (AS) – database containing credentials for all users, reachable by the authenticator.

 Extensible Authentication Protocol -Transport Layer Security  Widely supported but rarely used.  8-way handshake. Very secure but also very time consuming.  Doesn’t scale well when clients handoff often.

 PMK - Pairwise Master Key  PTK – Pairwise Transient Key  EMSK – Extended Master Session Key  RADIUS – Remote Authentication Dial In User Service. Uses a shared secret to cipher and authenticate the communication.

1. Authentication – PMK and EMSK generated on SA and Station. 2. AS moves PMK to Au by using RADIUS way handshake – PTK generated by Au and Station

 When a station changes access points, re- authenticating the PMK is slow.  Only the PTK needs to be renewed, and PMK can be left alone.  How do we transmit the PMK from Au1 to Au2????

 Au1 is a bad guy. Pushes false PMK  Sta is a bad guy that gets access to Au2  Sta is a good guy that gets a denial of service  Au2 is a bad guy. Pulls PMK from Au1. Now it can decipher traffic.

 Don’t use AS for re-authentication!  Pull/Push policies to transfer keys.  Provides good performance.  More complicated.  Use when:  Handover speed is crucial & path to the AU is long  Don’t want to be dependant on the AU server

 Contact the Au on every handover.  Slower performance.  Gained security.  Possible danger if the protocol used to move PMK is not strong. Need good reasons to transfer PMKs.

 Goal: reduce the number of packets required for TLS exchange by re-using information generated in the first authentication.  EMSK remained on the Authentication Server, so it can be used to re-authenticate the Station

Based on contacting the Authentication server Au PTK

 EAP-TLS took 2.34 seconds on average  Proposed protocol took 0.62 seconds on average  74% improvement over EAP- TLS!  82% improvement when including retransmissions

 Internet Engineering Task Force (IETF) – working on new standard to used the EMSK for re-authentication.  Pull and push methods to transfer keys for nodes within same mobility domains

 EAP-TLS is slow for re-authentication.  Big improvements can be made by following the proposed protocol, which  Reduces number of packets required  Reduces retransmissions  Decreases time

 Original paper written by: Romano Fantacci, Leonardo Maccari, and Tommaso Pecorella from:University of Florence Federico Frosali from: Telecom Italia Lab