The Difference Between IEEE 802.11i, IEEE 802.11r, IEEE 802.11k and IEEE 802.11w

IEEE 802.11i

IEEE 802.11i, also known as WPA2, is an amendment to the 802.11 standard specifying security mechanisms for wireless networks. The draft standard was ratified on 24 June, 2004, and supersedes the previous security specification, Wired Equivalent Privacy (WEP), which was shown to have severe security weaknesses. Wi-Fi Protected Access (WPA) had previously been introduced by the Wi-Fi Alliance as an intermediate solution to WEP insecurities. WPA implemented a subset of 802.11i. The Wi-Fi Alliance refers to their approved, interoperable implementation of the full 802.11i as WPA2. 802.11i makes use of the Advanced Encryption Standard (AES) block cipher; WEP and WPA use the RC4 stream cipher. 

The authentication process leaves two considerations: the access point (AP) still needs to authenticate itself to the client station (STA), and keys to encrypt the traffic need to be derived. The earlier EAP exchange has provided the shared secret key PMK (Pairwise Master Key). This key is however designed to last the entire session and should be exposed as little as possible. Therefore the four-way handshake is used to establish another key called the PTK (Pairwise Transient Key). The PTK is generated by concatenating the following attributes: PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address and STA MAC address. The product is then put through a cryptographic hash function. 

The handshake also yields the GTK (Group Temporal Key), used to decrypt multicast and broadcast traffic. The actual messages exchanged during the handshake are: 

1. The AP sends a nonce-value to the STA (ANonce). The client now has all the attributes to construct the PTK.
2. The STA sends its own nonce-value (SNonce) to the AP together with a MIC.
3. The AP sends the GTK and a sequence number together with another MIC. The sequence number is the sequence number that will be used in the next multicast or broadcast frame, so that the receiving STA can perform basic replay detection.
4. The STA sends a confirmation to the AP.

As soon as the PTK is obtained it is divided into three separate keys:

1. EAPOL-Key Confirmation Key (KCK) - The key used to compute the MIC for EAPOL-Key packets.
2. EAPOL-Key Encryption Key (KEK) - The key used to encrypt the EAPOL-Key packets.
3. Temporal Key (TK) - The key used to encrypt the actual wireless traffic.

IEEE 802.11r

The 802.11r standard is designed to speed handoffs between access points or cells in a wireless LAN. 802.11r refines the transition process of a mobile client as it moves between access points. The protocol allows a wireless client to establish a security and QoS state at a new access point before making a transition, which leads to minimal connectivity loss and application disruption. The overall changes to the protocol do not introduce any new security vulnerabilities. This preserves the behavior of current stations and access points.

During the initial association in a mobility zone, a 802.11r capable STA and AP perform an Open System Authentication exchange, followed by a a FT Reassociation Exchange that differs from 802.11 Reassociation Exchange by including an MDIE in the Reassociation Request to indicate that the STA wishes to use 802.11r. Moreover, a Fast Transition Information Element (FTIE) is included in the Reassiciation Response frame issued by the AP. The FTIE carries the R0KH-ID as well as the current access point's R1KH-ID. After successful 802.11X authentication, the AP and STA engage in a FT four-way handshake that differs from the 802.11i handshake by carrying extra MDIE and FTIE components, needed for the derivation of PMK-R1s and PTKs. 

Exchanges for performing subsequent handoffs within the mobility domain are slightly different. The 802.11r amendment attempts to reduce latency by overlaying key management on top of the 802.11 re association process. The Authentication Exchange and the Association Exchange are used to perform a FT Protocol exchange that allows the STA and AP to agree on the PMK-R1 and derive PTKs. The FT protocol thus replaces the FT four-way handshake and reduces the total number of messages to perform a full re-association to four. 

When the STA wishes to (pre-) associate with an AP over the distribution system, the STA and the AP perform an Over the DS FT Protocol exchange. The AP to which the STA is currently associated routes the frames between the STA and the target AP. The FT protocol over the DS uses a new FT Request/Response (Action Frames) Exchange to replace the Authentication exchange followed by an Association Exchange to negotiate cipher suites and derive PTKs on both the STA and the AP.

IEEE 802.11k

802.11k is a proposed standard for how a wireless local area network (WLAN) should perform channel selection, roaming, and transmit power control (TPC) in order to optimize network performance.

802.11k is intended to improve the way traffic is distributed within a network. In a wireless LAN, each device normally connects to the access point (AP) that provides the strongest signal.

Depending on the number and geographic locations of the subscribers, this arrangement can sometimes lead to excessive demand on one AP and underutilization of others, resulting in degradation of overall network performance. In a network conforming to 802.11k, if the AP having the strongest signal is loaded to its full capacity, a wireless device is connected to one of the underutilized APs. Even though the signal may be weaker, the overall throughput is greater because more efficient use is made of the network resources.

The following steps are performed before switching to a new access point.

1. Access point determines that client is moving away from it.
2. Informs client to prepare to switch to a new access point.
3. Client requests list of nearby access points
4. Access point gives site report
5. Client moves to best access point based on report

IEEE 802.11w

IEEE 802.11w is the Protected Management Frames standard. A key objective is preventing network disruption caused by malicious systems. 802.11w is considering protection to enable data integrity, data origin authenticity, replay protection, and data confidentiality. Support for 802.11w might be implemented by software.

To protect the confidentiality of management traffic, IEEE 802.11w assumes that the client and the access point have exchanged dynamic key content. This precludes the protection of any management frames prior to the delivery of key content, thus exposing network name (SSID) information and other capability information needed for clients to connect to the network. Maintaining backward compatibility for future non-IEEE 802.11w-compliant wireless devices will also be challenging for organizations, limiting the protection afforded by 802.11w until all hardware has been upgraded to support the required functionality.

http://wiki.freeradius.org/IEEE-802.11i

http://www.networkworld.com/details/7559.html

http://www.codealias.info/technotes/the_ieee_802.11r_standard_for_fast_wireless_handoffs

http://searchmobilecomputing.techtarget.com/definition/80211k

http://www.anritsums2711d.com/PDF/Anritsu%20MS2711D%20Spectrum%20Master%20-%20Must-Have%20Reference%20for%20Wireless%20Communications%20Whitepaper.pdf

http://www.networkworld.com/columnists/2006/052906-wireless-security.html

Microsoft’s Active Directory Security Feature

Introduction of Microsoft’s Active Directory

An active directory is a directory structure used on Microsoft Windows computers and servers to store information about networks and domains. It is primarily used for online information and was originally created in 1996. It was first used with Windows 2000. An active directory (sometimes referred to as an AD) has many functions. It provides information on objects, organizes these objects for easy retrieval and access, allows users and administrators to access it, and allows the administrator to set security up for the directory.

Security Features

Some examples of the security features are simplified user and network-resource management, flexible, secure authentication and authorization and also directory consolidation.

o   Simplified user and network-resource management  – using Active Directory, you can build hierarchical information structures that make it easier for you to control administrative credentials and other security settings and that make it easier for your users to locate network resources, such as files and printers.

o   Flexible, secure authentication and authorization  – the services provide protection for data while minimizing barriers to doing business over the Internet. Active Directory supports multiple authentication protocols, such as the Kerberos V5 protocol, Secure Sockets Layer (SSL) v3, and Transport Layer Security (TLS) using X.509 v3 certificates, and security groups that span domains efficiently.

o   Directory consolidation  – you can organize and simplify the management of users, computers, applications, and devices, and make it easier for users to find the information they need. You can take advantage of synchronization support through Lightweight Directory Access Protocol (LDAP)-based interfaces, and you can work with directory consolidation requirements specific to your applications.

http://www.tech-faq.com/active-directory.html

http://technet.microsoft.com/en-us/library/cc737139%28WS.10%29.aspx

LDAP Security Feature

Introduction of LDAP

The Lightweight Directory Access Protocol (LDAP) is an Internet protocol for accessing distributed directory services that act in accordance with X.500 data and service models. This document provides a road map of the LDAP Technical Specification. LDAP is an extensible protocol.  Extensions to LDAP may be specified in other documents.

Security Features

Examples of security features include authentication, Secure Sockets Layer (SSL) and also uses hashed-method for password.

o   Authentication – uses NTLM or basic authentication to limit the access of known users only. Authentication LDAP also supports negotiate which uses clear text passwords. The negotiate security package selects between Kerberos and NTLM. Negotiate uses Kerberos unless it cannot be used by one of the systems which involved authentication.

o   Secure Sockets Layer – SSL is a protocol that helps protect data from packet sniffing by sniffers with the access of the physical access to the network.

o   Hashed-method for password – there are shadow-password schemes that prevent `ordinary' users from getting hold of the hash data, but these are fairly easy to bypass when used with a NIS. With access to a collection of password hashes, a cracker can mount a dictionary attack with a good chance of success so it would be better to keep the hashes away from client machines entirely.

http://tools.ietf.org/html/rfc4510

http://msdn.microsoft.com/en-us/library/aa913688.aspx

http://www.skills-1st.co.uk/papers/security-with-ldap-jan-2002/security-with-ldap.html

http://www.filehold.com/sites/all/files/images/active-directory-integration.jpg

X.500 Security Feature

Introduction of X.500 

X.500 is a directory standard for how information about objects is retrieved, deleted, stored, managed, updated and also protected. X.500 has been created and has been developing for 23 years. The X.500 standard has an extensive specifications consisting of ten documents like for example, X.500, X.501, X.509, X.511, X.518, X.519, X.520, X.521, X.525 and also X.530. X.509 is widely known as the basis for digital signatures and also PKI (Public Key Infrastructure). X.500 standard is developed jointly between ITU-T and ISO/IEC. ISO/ IEC.

Security Features

Examples of the security features are strong authentication, access control and also digital signature.

o   Strong authentication – it helps to build trust between the X.500 directory components, validates the identity of directory users for access control and also protect against replay and denial-of-service attacks.

o   Access control – it has a standard that defines the security mechanisms to protect information in the directory and also restrict user access to it meaning the users are restrict from seeing it or even modifying the information.

o   Digital signature – a message encrypted by the private key can be decrypted by anyone holding a copy of the public key. If decryption is possible, only the holder of the private key could have sent this message. This technique is used to create digital signatures. When a message is to be digitally signed, a hash of the message is created. The hash is encrypted using the private key and appended to the message as a digital signature. The receiver decrypts the signature using the public key. It then creates its own hash of the message. If the two hashes are identical, the receiver knows that the message has been transmitted unchanged and that the sender’s identity is known with a high level of certainty. This gives an end-to-end security also in a distributed environment.

http://www.firstnetsecurity.com/library/misc/LDAP.pdf

http://csrc.nist.gov/archive/pki-twg/Archive/y1999/presentations/twg-99-26.pdf

http://www.telenor.com/en/resources/images/160-164_X500Standard_tcm28-36850.pdf

http://www.x500standard.com/uploads/X500/x500comp.png

GPRS Security Feature, Threats and Solution

Introduction of GPRS

GPRS which also means (General Packet Radio Service) is a data network architecture that is designed to integrate with existing GSM networks and offer mobile subscribers the “always on” packet switched data services access to corporate networks and the Internet. GPRS provides mobile operators with an opportunity to offer higher-margin data access services to subscribers. Some examples of GPRS threats are identity confidentiality, identity authentication and also confidentiality of both the user data and signaling between the mobile and the GPRS serving node.

Security Features

Identity confidentiality means that it provides privacy to the subscriber so that it will be difficulty to identify the person from their signal over the radio and connections to the SGSN. Identity authentication means it will be performed within the SGSN. Pairs of Random Numbers and Signed responses (RAND & SRES) are obtained from the HLR/AUC and stored within the SGSN.

Threats 

Some example of threats GPRS faces are GPRS encryption is limited to the radio access network and also the firewalls are inadequate against attacks that originate from malicious mobile subscribers, network operator personnel and also any other third party that gets access to the GPRS backbone. 

Solutions

Example of the GPRS solutions includes stateful packet inspection which means that it uses a security policy that only allows the MS to initiate connections to the public network and implement stateful packet filtering so that the MS never sees traffic that is initiated from the public network. Ingress and egress packet filtering whereby it helps to prevent the possibility of spoofed MS to MS data by blocking incoming traffic with the source addresses which are the same as those assigned to an MS for public network access.

http://netscreen.com/solutions/literature/white_papers/200074.pdf

http://www.brookson.com/gsm/gprs.pdf      

http://critis06.lcc.uma.es/files/Vulnerabilities%20and%20Possible%20Attacks%20against%20the%20GPRS%20Backbone%20Network.pdf