Datasheet. Millimeter-Wave Radio (MMW) Security of MMW. Overview

Transcription

1 Datasheet Millimeter-Wave Radio (MMW) Security of MMW Overview About Wireless Excellence Founded in 1996 and with headquarters in Oxford UK, Wireless Excellence Limited is a leading designer and supplier of outdoor and indoor Broadband Wireless communication products. With a complete range of solutions including Radio, Microwave, Millimeter Wave, Free Space Optics, WiFi and 4G/5G/LTE, customers in over 80 countries have chosen Wireless Excellence as the one stop shop solution of choice for dependable wireless networking. About Millimeter-Wave CableFree MMW links offer high performance connections using Millimeter Wave frequencies. MMW is a high frequency microwave technology offering bandwidths of up to 10Gbps Full Duplex capacity or 40Gbps. Millimeter Wave technology is complimentary to FSO (Free Space Optics) and ideal for dense urban areas where radio spectrum is congested. Planning for Millimeter Wave is based on rainfall, giving useful transmission distances of many kilometres.

2 Security of MMW Links CableFree: Wireless Excellence manufactures a complete range of microwave radio and millimeter-wave (MMW) communication systems designed for point-to-point and point-to-multipoint operation. Many users expect and demand high levels of security of transmitted data and protection against network intrusion by unauthorised users. Many customers use Wireless Excellence MMW links for secure networking applications such as government, finance, defence and telecom networks. Specific features of Wireless Excellence MMW links ensure they are inherently secure The Physical Layer MMW is inherently secure Narrow Beam Transmission CableFree MMW links use narrow pencil beams of around 1 degree divergence to transmit data between sites. This compares with 0.5degrees (FSO), 10 degrees (5.8GHz radio), 2-4 degrees (6-38GHz licensed microwave) and 360 degrees (WiFi). MMW units are typically mounted up on rooftops or telecom towers, which mean that the beam is not accessible from street level. Looking at our simple diagram here, it can be seen that the MMW signal can only be connected to in a narrow corridor of air between two points. In normal installations It is not possible to access the MMW signal from ground level, or using a hand-scanner, laptop or PDA. Signal Levels and Link Budgets Gigabit MMW links use a wide spectrum with lower order modulation to achieve 1Gbps net throughput; correspondingly the sensitivity of the MMW receiver is limited at this bandwidth. Hence the link budget of an outdoor MMW link requires large antennas (30cm+) for any significant operating distance, which are visually obvious, and have to be mounted in-line with the transmission path. This is the converse to WiFi where the far lower bandwidths mean receivers can connect at much longer distances, higher beam divergences and lower signal levels. Low Sidelobes through advanced design Wireless Excellence MMW links feature very low sidelobes due to high quality and design of antennas and feeds used; these sidelobes are at very low intensity level compared to the main which make them consequently harder to detect or intercept. At frequencies, these sidelobes are still very close to the main axis of transmission and therefore do not represent a security threat. 60GHz: Oxygen absorption This is a unique property that does not affect lower-frequency Oxygen attenuates 60GHz signals by 12-16dB per kilometer (i.e., the energy is absorbed for every 200 meters the signal travels), is the main reason that 60GHz links cannot cover the distances achieved by other millimeter-wave links. From a security perspective this makes 60GHz links very covert because the cannot be received or detected at any great range from the transmitting site; and conversely, interference is highly unlikely Proprietary Airside Line Coding the beam, MMW radios. half of which signal Wireless Excellence MMW radios use proprietary airside line coding which makes the intercept and decoding of data harder. Only an identically-configured Wireless Excellence MMW radio would correctly receive and decode the communication signals. Also, the ends of the link receive and transmit on different frequencies; making it still harder to intercept, as both frequencies/beams have to be detected, intercepted and decoded, without disrupting the original beam. Adding Extra Layers of Security Wireless Excellence always advocates a multi-layered policy to security; a single layer of security is never considered enough in a secure modern communications environment. Wireless Excellence offers a range of Gigabit Routers which can add secure tunnels operating over the wireless infrastructure at full 1Gbps line rate. The choice of tunnel and encryption covers most commercial and additional proprietary tunnelling protocols including L2TP, IPSEC, Firewall features. Please see a description of these below also.

3 Intercepting an MMW link Intercept of MMW signals is non-trivial. The following explanation should help: The system carries network traffic which is full duplex, i.e. it is of little point gathering one direction alone - so both send and return paths need to be intercepted, and the both signals then analysed. Breaking the beam causes network transmission to stop - not of the actual MMW signal pulses, but the network traffic, which will indicate "port down" and issue just the training signal ( for Fast Ethernet, and the K28.5 alignment word for Gigabit Ethernet) with no user data. "Hacking into" such a system would require packets to be inserted into the stream - for example, requests for logon, download etc - which would mean inserting an MMW beam with the "rogue" packets - which by doing so would upset the main beam - the only way to do this would be to tap of the **entire** MMW beam, pass through a "rogue packet inserter" and then pass the corrupt signal back to the intended receiver- - that takes 2 reflectors, both blocking the entire transmission path - and some very complex equipment to do it. Note this is completely different to (WiFi) radio, where the "shared medium" of 2.4 or 5.xGHz allows a third radio to "associate" and potentially "log into" the access point. With MMW, there is no "shared medium" - it is simply two MMW beams, one in each direction. Attempts to "tap" the transmission path would always be physically obvious, with either mirrors or reflectors held (with precision mounts - hand-held does not work) in-between the units, or possibly just behind them. Any "tapping off" of signal causes a loss, which is very obvious on the Wireless Excellence management software - a 5% tapping of MMW signal would result in a 5% drop in received signal. Wireless Excellence management software can be set with user-programmable alarms which can show up and warn users in such an event. Gigabit Router Functions: Layer 3 Security features Firewall The firewall implements packet filtering and thereby provides security functions that are used to manage data flow to, from and through the router. Along with the Network Address Translation it serve as a tool for preventing unauthorized access to directly attached networks and the router itself as well as a filter for outgoing traffic. Network firewalls keep outside threats away from sensitive data available inside the network. Whenever different networks are joined together, there is always a threat that someone from outside of your network will break into your LAN. Such break-ins may result in private data being stolen and distributed, valuable data being altered or destroyed, or entire hard drives being erased. Firewalls are used as a means of preventing or minimizing the security risks inherent in connecting to other networks. Wireless Excellence implements wide firewalling features as well as masquerading capabilities, which allows you to hide your network infrastructure from the outside world. L2TP (Layer 2 Tunnel Protocol) L2TP supports encrypted tunnels over IP. The Wireless Excellence implementation includes support for both L2TP client and server. General applications of L2TP tunnels include: secure router-to-router tunnels over the Internet linking (bridging) local Intranets or LANs (in cooperation with EoIP) extending PPP user connections to a remote location (for example, to separate authentication and Internet access points for ISP) accessing an Intranet/LAN of a company for remote (mobile) clients (employees) Each L2TP connection is composed of a server and a client. The OS may function as a server or client or, for various configurations, it may be the server for some connections and client for other connections. IPSEC (IP Security) IPsec supports secure (encrypted) communications over IP networks. Encryption

4 Before putting a data packet into the interface queue, IPsec policy database is consulted to find out if packet should be encrypted. Security Policy Database (SPD) is a list of rules that have two parts: Packet matching - packet source/destination, protocol and ports (for TCP and UDP) are compared to values in policy rules, one after another Action - if rule matches action specified in rule is performed: o accept - continue with packet as if there was no IPsec o drop - drop packet o encrypt - encrypt packet Each SPD rule can be associated with several Security Associations (SA) that determine packet encryption parameters (key, algorithm, SPI). Note that packet can only be encrypted if there is usable SA for policy rule. By setting SPD rule security "level" user can control what happens when there is no valid SA for policy rule: use - if there is no valid SA, send packet unencrypted (like accept rule) acquire - send packet unencrypted, but ask IKE daemon to establish new SA require - drop packet, and ask IKE daemon to establish new SA. Decryption When an encrypted packet is received for local host, the appropriate SA is looked up to decrypt it (using packet source, destination, security protocol and SPI value). If no SA is found, the packet is dropped. If SA is found, packet is decrypted. Then decrypted packet's fields are compared to policy rule that SA is linked to. If the packet does not match the policy rule it is dropped. If the packet is decrypted fine (or authenticated fine) it is processed for local delivery. Note that before forward and input firewall chains, a packet that was not decrypted on local host is compared with SPD reversing its matching rules. If SPD requires encryption (there is valid SA associated with matching SPD rule), the packet is dropped. This is called incoming policy check. The diagram above shows the Wireless Excellence Gigabit Router packet flow through the router:

5 Wireless Excellence MMW Security summary Narrow beams ensure high levels of inherent security at the Physical Layer Proprietary Airside signals mean that only Wireless Excellence radios can connect MMW signals are inherently hard to detect Breaking the beam stops data flow, halting traffic Optional Gigabit Routers with multi-layer security and intrusion prevention/detection Wireless Excellence s MMW products are probably the most secure radio units in the entire industry, with highly secure physical layer, optional multi-layered security, proprietary as well as industry-standard features. In addition, advanced features in the management system to spot any attempt to intrude or tamper with the transmission and take corrective action. External Security Assessment UK Government For applications in the UK when information transmitted is covered by the Official Secrets Act (such as governmental departments and defence organisations) a security threat audit for specific installations may be carried out by the Communications Electronics Security Group, based at GCHQ in Cheltenham. T: +44 (0870) E: sales@cablefree.net W: Wireless Excellence Limited The Oxford Science Park, G6, Magdalen Centre Robert Robinson Avenue, Oxford OX4 4GA