1. Effortless Secure Wireless Enrollment Jeff Shirley David Evans

2. jshirley@cs.virginia.edu Jeff Shirley About Me Second year PhD student under David Evans Second year PhD student under David Evans Research interests primarily in security topics Research interests primarily in security topics Projects Projects –“Automatically Hardening Web Applications Using Precise Tainting” - Anh Nguyen-Tuong, Salvatore Guarnieri, Doug Greene, Jeff Shirley, David Evans (published 30 May, SEC 05)  Automatically securing PHP applications –“Effortless Secure Wireless Enrollment” – w/ David Evans  Improving methods for enrolling clients on secured wireless networks

3. jshirley@cs.virginia.edu Jeff Shirley Secure Wireless Enrollment Mutual authentication between network and wireless client during enrollment Mutual authentication between network and wireless client during enrollment –Enrolling temporary users –Visitors How to verify that the enrollee is the newly authorized user? How to verify that the enrollee is the newly authorized user? How to verify that the wireless network is the trusted network? How to verify that the wireless network is the trusted network?

4. jshirley@cs.virginia.edu Jeff Shirley Location-Limited Side Channels Network limits enrollment to clients physically present at specific location Network limits enrollment to clients physically present at specific location –Clients connect only to network verified through the same channel USB, Audio [Balfanz+, NDSS 2002] USB, Audio [Balfanz+, NDSS 2002] Visual [McCune+, Oakland 2005] Visual [McCune+, Oakland 2005] Audio tones Audio tones –Human evident, relatively limited range –Available on a wide variety of devices (laptops, PDAs, cellphones, etc.)

5. jshirley@cs.virginia.edu Jeff Shirley Enrollment Techniques Compared Conventional Wireless Enrollment Not based on physical verification of client identity (often, passwords are used) Not based on physical verification of client identity (often, passwords are used) Uses a single authentication channel Uses a single authentication channel Little or no authentication of the wireless network to the clients Little or no authentication of the wireless network to the clients Evident to computers, but not humans Evident to computers, but not humans Often requires manual key transfer for secured networks Often requires manual key transfer for secured networks Enrollment w/ Location- Limited Channels Limits enrollment to client devices physically present at a specific location Limits enrollment to client devices physically present at a specific location Uses multiple authentication channels (audio + wireless) Uses multiple authentication channels (audio + wireless) Can authenticate both ways Can authenticate both ways Human evident and tamper evident Human evident and tamper evident Enrollment can be almost completely automated with little loss of security Enrollment can be almost completely automated with little loss of security

6. jshirley@cs.virginia.edu Jeff Shirley Previously authorized user acts as intermediary Previously authorized user acts as intermediary Audio challenge-response protocol Audio challenge-response protocol Enrollment Protocol Audio ChannelWirelessWired Network C C { } KP S {N a } KU c + N a +{N b } KU a N b +{ } KP S New Client Authorized Enroller Enrollment Server

7. jshirley@cs.virginia.edu Jeff Shirley Current Status Working implementation Working implementation Distributing client software securely Distributing client software securely –Signed Java applets available from insecure wireless network Ensuring interoperability with existing systems Ensuring interoperability with existing systems –Initial implementation of the protocol enrolls users for standard EAP-TLS authentication Tradeoff between reliability of audio channel and transmission speed (3.0 - 4.5 bytes/s) Tradeoff between reliability of audio channel and transmission speed (3.0 - 4.5 bytes/s)

8. jshirley@cs.virginia.edu Jeff Shirley Demo Enrollment/key exchange takes place through audio tones Enrollment/key exchange takes place through audio tones Two Java applets Two Java applets –One on new enrollee’s machine –One on machine controlled by previously authorized user

9. jshirley@cs.virginia.edu Jeff Shirley Questions? Email: jshirley@cs.virginia.edu Email: jshirley@cs.virginia.edujshirley@cs.virginia.edu