1. Secure WNM Requirements
Month Year
May 2005
May 2005
Secure WNM Requirements
Authors:
Date:
Notice: This document has been prepared to assist IEEE It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein.
Release: The contributor grants a free, irrevocable license to the IEEE to incorporate material contained in this contribution, and any modifications thereof, in the creation of an IEEE Standards publication; to copyright in the IEEE’s name any IEEE Standards publication even though it may include portions of this contribution; and at the IEEE’s sole discretion to permit others to reproduce in whole or in part the resulting IEEE Standards publication. The contributor also acknowledges and accepts that this contribution may be made public by IEEE
Patent Policy and Procedures: The contributor is familiar with the IEEE 802 Patent Policy and Procedures < ieee802.org/guides/bylaws/sb-bylaws.pdf>, including the statement "IEEE standards may include the known use of patent(s), including patent applications, provided the IEEE receives assurance from the patent holder or applicant with respect to patents essential for compliance with both mandatory and optional portions of the standard." Early disclosure to the Working Group of patent information that might be relevant to the standard is essential to reduce the possibility for delays in the development process and increase the likelihood that the draft publication will be approved for publication. Please notify the Chair as early as possible, in written or electronic form, if patented technology (or technology under patent application) might be incorporated into a draft standard being developed within the IEEE Working Group. If you have questions, contact the IEEE Patent Committee Administrator at
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

2. Month Year
May 2005
May 2005
Abstract
This document provides threat analysis and suggests protection service requirements for Wireless Network Management.
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

3. Agenda Possible Service Categories for WNM Threat Analysis for WNM
Month Year
May 2005
May 2005
Agenda
Possible Service Categories for WNM
Threat Analysis for WNM
Requirements for TGw
Requirements for TGv
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

4. Setting MIB parameters over the air has security implications
Month Year
May 2005
May 2005
Purpose of v (from PAR)
Enables management of attached stations in a centralized or in a distributed fashion (e.g. monitoring, configuring, and updating) through a layer 2 mechanism.
Setting MIB parameters over the air has security implications
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

5. Month Year
May 2005
May 2005
Possible Service Categories for v (doc. : 0076r00 by John Klein, et al)
Configuration Management
Performance and Resource Management
Operations Management
Fault and Security Management
Accounting Management
Location Services, etc.
(refereed to doc.:0076r00 by John Klein, et al)
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

6. Threats to Wireless Network Mangement
Month Year
May 2005
May 2005
Threats to Wireless Network Mangement
Forgery Attack
Masquerade
Delay Attack
Disclosure
Denial of Service
Traffic Analysis
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

7. Month Year
May 2005
May 2005
Forgery Attack
An unauthorized entity could set or change any unprotected management parameter, including those related to configuration, operations, and accounting
WNM message could be reordered or replayed to effect unauthorized management operations
For example, an unauthorized entity could modify load balancing message to direct the STA to another AP
Requirement:
Need Forgery Protection - TGw
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

8. Masquerade Requirement:
Month Year
May 2005
May 2005
Masquerade
An unauthorized entity may attempt some management operations by assuming the identity of an authorized entity
For example, an unauthorized AP, who is not authorized for STA’s firmware update, may attempt to update STA’s firmware
Requirement:
Need to provide policy advertisement, discovery, and negotiation to agree upon which WNM messages the peer is authorized to send – TGv
Need to define its own Access Control mechanism – TGv
Need Authentication and Authorization Protection – TGw
STA and AP
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

9. Month Year
May 2005
May 2005
Delay Attack
WNM management message could be delayed to effect invalid management operations.
Delay attack is similar to a replay attack, but because of man-in-the-middle nodes, hidden nodes, power save mode, etc., the frames are received in sequence, so do not appear as retries
In normal replay attack, frames are received out of sequence or more than one time
For example, a delayed Load Balancing message may not be valid any more.
Suggested Requirement:
Need Delay Protection – TGw
Need Timeliness for management message - TGv
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

10. Disclosure Requirement:  Need Confidentiality Protection - TGw
Month Year
May 2005
May 2005
Disclosure
An entity could observe data exchanged between an AP and a STA and thereby learn the values of managed objects and learn of notify-able events
For example, the observation of a set of location information and management (for Location Service) would enable an attacker to learn asset tracking
Because of privacy concerns, Manager (AP) and Agent (STA) may not want a third party to know their accounting parameter setting (for Accounting Management)
WNM policy needs to be consistent with SNMP v3 policy for confidentiality, because all WNM objects are in the SNMP MIB
If SNMP policy requires confidentiality, then so does WNM.
Requirement:
 Need Confidentiality Protection - TGw
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

11. Denial-of-service An attacker may prevent exchange between AP and STA
Month Year
May 2005
May 2005
Denial-of-service
An attacker may prevent exchange between AP and STA
Wireless Network Connection Failure
Disruption of all type of exchanges
Management message forgery can create novel denial-of-service attacks
#1 and #2 are not new denial-of-service threats and can be implemented by PHY. Accordingly, the MAC cannot protect against them.
#3 needs forgery protection - TGw
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

12. Month Year
May 2005
May 2005
Traffic Analysis
An attacker may observe the general pattern of management traffic between AP and STA
Algorithms to defeat traffic analysis fill the channel with random noise and pad all frames to the same length – decreases available bandwidth – not viable commercially.
Wireless Network traffic patterns in WLANs based on commercial equipment are predictable, and therefore there is no significant advantage to protect against observing these traffic patterns.
Protecting against traffic analysis destroys the value of a WLAN
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

13. Suggested Requirements for TGw (summary)
Month Year
May 2005
May 2005
Suggested Requirements for TGw (summary)
Authentication Protection
Authorization Protection
Forgery Protection
Replay Protection
Confidentiality Protection
Delay Protection ?
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

14. Suggested Requirements for TGv (1)
Month Year
May 2005
May 2005
Suggested Requirements for TGv (1)
Requirement: Need to provide policy advertisement, discovery, and negotiation to agree upon which WNM messages the peer is authorized to send
Require backward compatibility with pre-TGv STAs and APs
Each STA or AP will have its own policy of whether to interpret WNM messages as commands, advice, or irrelevant
operates in unlicensed band, so no guarantee any message will be interpreted as a command
Many platforms are open and owned by some entity other than the network owner, so no guarantee they will respond to WNM messages as “commands”
Cover Enterprise, Home, and Hotspot for usage scenarios
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

15. Suggested Requirements for TGv (2)
Month Year
May 2005
May 2005
Suggested Requirements for TGv (2)
Requirement: Need Timeliness for managements message :
The manager (sender) should dictate that a message must be received within a reasonable time window, to avoid delay attacks.
The time window should be chosen to be as small as possible given the accuracy of the clocks involved and round-trip communication delays
The receiver should conduct a timeliness check when message arrives
Emily Qi, Intel Corporation
Emily Qi, Intel Corporation

16. May 2005
Feedback?
Emily Qi, Intel Corporation