Countermeasures to WEP Protocol Vulnerabilities
Now that it is clear that many 802.11 networks employ the standard WEP protocol, which is known to have major faults, some 802.11 vendors have come up with proprietary solutions. Before the official IEEE 802.11i was released, Cisco created proprietary solutions to address WEP protocol vulnerabilities. The WEP protocol contains three components:
• Authentication framework
• Authentication algorithm
• Data privacy or encryption algorithm
The Cisco Wireless Security Suite contains an enhancement that exceeds the WEP functionality for each of the components in the previous list.
The IEEE 802.1x standard provides a framework for authentication. A new user-based authentication algorithm with the ability to generate dynamic WEP keys has been developed. This algorithm is called the Extensible Authentication Protocol (EAP). Cisco Light Extensible Authentication Protocol (LEAP) is a proprietary Cisco authentication protocol designed for use in IEEE 802.11 WLAN environments. LEAP's main focuses are on mutual authentication between the network infrastructure and the user, secure derivation of random and user-specific cryptographic session keys, and most importantly, compatibility with existing and widespread network authentication mechanisms (for example, RADIUS).
Additionally, Cisco has developed the Temporal Key Integration Protocol (TKIP) to improve WEP privacy and encryption.
EAP Protocol and the 802.11i Standard
The 802.1x authentication framework is included in the draft for 802.11 MAC layer security enhancements in the IEEE 802.11i specification. The
802.1x framework provides the link layer with extensible authentication normally seen in higher layers. One of the higher layers is EAP, which is also Cisco proprietary. EAP allows negotiation of an authentication protocol for authenticating its peer before allowing network layer protocols to transmit over the link. Figure 14-9 illustrates the relationship between these sublayers.
Figure 14-9. 802.1x Authentication Framework
Figure 14-9. 802.1x Authentication Framework
EAP is defined in RFC 2284 and was developed to provide strong, easy-to-deploy, and easy-to-administer wireless security. Cisco offers third-party NIC support and RADIUS support to allow customers to use their existing investments in wireless clients as well as existing RADIUS servers. Figure 14-10 illustrates the message flow for the EAP protocol with RADIUS as the authentication method.
Figure 14-10. Authentication Framework with RADIUS
Figure 14-10. Authentication Framework with RADIUS
As you can see in Figure 14-10, the authentication framework process consists of multiple steps:
Step 1.
The station determines 802.11i support from a beacon that is transmitted from the access point.
Step 2. The station starts the session with an EAP frame.
Step 3. The access point sends an EAP identity request message back to the station.
Step 4. The station sends an EAP response (including the station's ID).
Step 5. The access point forwards the packet to the RADIUS server.
Step 6. The RADIUS server sends a response back to the access point including a challenge (EAP authentication type).
Step 7. The access point forwards the challenge to the station.
Step 8. The station sends a challenge response message back (EAP type set to RADIUS).
Step 9. The access point forwards the response to the RADIUS server.
Step 10. The RADIUS server sends an accept message to the access point.
Step 11. The access point forwards an EAP success message to the station.
Step 12. The station is ready to send data.
At this point in time, VPN, IPSec, and SSH, which encrypt all data from the client applications to server applications, make the transaction more secure than only EAP. They are therefore recommended as an additional implemented security layer.
Network administrators should be aware that WLAN deployments should be made as secure as possible, knowing that security is weak in the 802.11 standard. Adding the Cisco Wireless Security Suite can increment security and help to create secure WLANs. The following link describes the Cisco Wireless Security Suite:
http://www.cisco.com/en/US/netsol/ns340/ns394/ns348/ns386/networking solutions white paper09186a00800b3d27.shtml.
Continue reading here: War Driving and War Chalking
Was this article helpful?