Princess Nora Bint Abdulrahman University College of computer and information sciences Networks department Networks Security (NET 536) Prepared by Dr. Samia Chelloug E-mail: samia_chelloug@yahoo.fr
Content 1. Basics of computer and network security. 2. Impact of network architecture on network security. 3. Basics of network design. 4. Firewalls and virtual private networks. 5. Internet and wireless network security. 6. Impact of operating systems models on network security. 7. How to secure an application?
References William Stallings, Cryptography and Network Security: Principles and practice, Fifth edition, 2011.
Part 5 : Wireless network security
IEEE 802.11 IEEE 802 is a committee that has developed standards for a wide range of local area networks (LANs). In 1990, the IEEE 802 Committee formed a new working group, IEEE 802.11, with a charter to develop a protocol and transmission specifications for wireless LANs (WLANs). Since that time, the demand for WLANs at different frequencies and data rates has exploded.
IEEE 802.11 IEEE 802.11 standards are defined within the structure of a layered set of protocols. PHYSICAL LAYER includes such functions as encoding/decoding of signals. In addition, the physical layer includes a specification of the transmission medium. In the case of IEEE 802.11, the physical layer also defines frequency bands and antenna characteristics. MEDIA ACCESS CONTROL All LANs consist of collections of devices that share the network s
IEEE 802.11 transmission capacity. Some means of controlling access to the transmission medium is needed to provide an orderly and efficient use of that capacity. This is the function of a media access control (MAC) layer. The MAC layer receives data from a higher-layer protocol, typically the Logical Link Control (LLC) layer, in the form of a block of data known as the MAC service data unit (MSDU). In general, the MAC layer performs the following functions: On transmission, assemble data into a frame, known as a MAC protocol data unit (MPDU)
IEEE 802.11 with address and error-detection fields. On reception, disassemble frame, and perform address recognition and error detection. Govern access to the LAN transmission medium. LOGICAL LINK CONTROL : in the LAN protocol architecture, these two functions are split between the MAC and LLC layers. The MAC layer is responsible for detecting errors and discarding any frames that contain errors. The LLC layer optionally keeps track of which frames have been successfully received and retransmits unsuccessful frames.
IEEE 802.11
MPDU format MAC Control: This field contains any protocol control information needed for the functioning of the MAC protocol. For example, a priority level could be indicated here. MAC Service Data Unit: The data from the next higher layer. CRC: The cyclic redundancy check field; also known as the Frame Check Sequence (FCS) field. The CRC is calculated based on the bits in the entire MPDU. The sender calculates the CRC and adds it to the frame. The receiver performs the same calculation on the incoming MPDU and compares that calculation to
MPDU format the CRC field in that incoming MPDU. If the two values don t match, then one or more bits have been altered in transit. The header and trailer contain control information that accompany the data field and that are used by the MAC protocol.
IEEE 802.11 components IEEE 802.11 Extended service set
IEEE 802.11 network components The smallest building block of a wireless LAN is a basic service set (BSS), which consists of wireless stations executing the same MAC protocol and competing for access to the same shared wireless medium. A BSS may be isolated, or it may connect to a backbone distribution system (DS) through an access point (AP). The AP functions as a bridge and a relay point. If one station in the BSS wants to communicate with another station in the same BSS, the MAC frame is first sent from the originating station to the AP and then from the AP to the destination station.
IEEE 802.11 network components A MAC frame from a station in the BSS to a remote station is sent from the local station to the AP and then relayed by the AP over the DS on its way to the destination station. When all the stations in the BSS are mobile stations that communicate directly with one another (not using an AP), the BSS is called an independent BSS (IBSS). An IBSS is typically an ad hoc network. In an IBSS, the stations all communicate directly, and no AP is involved. An extended service set (ESS) consists of two or more basic service sets interconnected by a distribution system.
IEEE 802.11 services
IEEE 802.11 services DISTRIBUTION OF MESSAGES WITHIN A DS Distribution is the primary service used by stations to exchange MPDUs when the MPDUs must traverse the DS to get from a station in one BSS to a station in another BSS. For example, suppose a frame is to be sent from station 2 (STA 2) to station 7 (STA 7). The frame is sent from STA 2 to AP 1, which is the AP for this BSS. The AP gives the frame to the DS, which has the job of directing the frame to the AP associated with STA 7 in the target BSS. AP 2 receives the frame and forwards it to STA 7.
IEEE 802.11 services DISTRIBUTION OF MESSAGES WITHIN A DS The integration service enables transfer of data between a station on an IEEE 802.11 LAN and a station on an integrated IEEE 802.x LAN. The term integrated refers to a wired LAN that is physically connected to the DS and whose stations may be logically connected to an IEEE 802.11 LAN via the integration service. The integration service takes care of any address translation and media conversion logic required for the exchange of data.
IEEE 802.11 services ASSOCIATION-RELATED SERVICES The primary purpose of the MAC layer is to transfer MSDUs between MAC entities; this purpose is fulfilled by the distribution service. For that service to function, it requires information about stations within the ESS that is provided by the association-related services. Before the distribution service can deliver data to or accept data from a station, that station must be associated.
IEEE 802.11 services ASSOCIATION-RELATED SERVICES Association: Establishes an initial association between a station and an AP. Before a station can transmit or receive frames on a wireless LAN, its identity and address must be known. For this purpose, a station must establish an association with an AP within a particular BSS. The AP can then communicate this information to other APs within the ESS to facilitate routing and delivery of addressed frames.
IEEE 802.11 services ASSOCIATION-RELATED SERVICES Reassociation: Enables an established association to be transferred from one AP to another, allowing a mobile station to move from one BSS to another. Disassociation: A notification from either a station or an AP that an existing association is terminated. A station should give this notification before leaving an ESS or shutting down. However, the MAC management facility protects itself against stations that disappear without notification.
IEEE 802.11 Wireless security problem: Despite the productivity, convenience and cost advantage that WLAN offers, the radio waves used in wireless networks create a risk where the network can be hacked. 1.Denial of service: the intruder floods the network with either valid or invalid messages affecting the availability of the network resources. Due to the nature of the radio transmission, the WLAN are very vulnerable against denial of service attacks. The relatively low bit rates of WLAN can easily be overwhelmed and leave them open to denial of service attacks
2. Spoofing: IEEE 802.11 This is where the attacker could gain access to privileged data and resources in the network by assuming the identity of a valid user. This happens because 802.11 networks do not authenticate the source address, which is Medium Access Control (MAC) address of the frames. Attackers may therefore spoof MAC addresses.
3. Eavesdropping: IEEE 802.11 This involves attack against the confidentiality of the data that is being transmitted across the network. By their nature, wireless LANs intentionally radiates network traffic into space. This makes it impossible to control who can receive the signals in any wireless LAN installation. In the wireless network, eavesdropping by the third parties is the most significant threat because the attacker can intercept the transmission over the air from a distance, away from the premise of the company.
IEEE 802.11 Wired Equivalent privacy (WEP) WEP is a standard encryption for wireless networking. It is a user authentication and data encryption system from IEEE 802.11 used to overcome the security threats. Basically, WEP provides security to WLAN by encrypting the information transmitted over the air. Only the receivers who have the correct encryption key can decrypt the information.
WEP encoded MPDU IEEE 802.11
IEEE 802.11 Wired Equivalent privacy (WEP) The IV contains a 6 bit padding and a 2 bit key ID, so only the rest 24 bits contain an actual Initialization Vector. IV is concatenated with a key, which is one of the four possible keys indicated by the key ID. This forms a seed to the RC4 stream cipher, resulting in a key stream. The key stream is XOR'ed with the concatenation of the plaintext and a 32 bit Integrity Check Value.
IEEE 802.11 Wired Equivalent privacy (WEP)
IEEE 802.11 Key scheduling algorithm j = 0 For i = 0 to 7 do j = (j + S[i] + T[i]) mod 8 Swap(S[i],S[j]) end
IEEE 802.11 Pseudo random generation algorithm i, j = 0; while (true) { i = (i + 1) mod 8; j = (j + S[i]) mod 8; Swap (S[i], S[j]); t = (S[i] + S[j]) mod 8; k = S[t]; }
RC4 example: Assume we use a 4 x 3-bit key, K, and a plaintext P as below: K = [1 2 3 6] P = [1 2 2 2] IEEE 802.11 Initialize the state vector S and the temporary vector T. S is initialized such that the S[i] = i, and T is initialized such that it is the key K (repeated as necessary). S = [0 1 2 3 4 5 6 7] T = [1 2 3 6 1 2 3 6] I = 0 : Swap(S[0],S[1]); So in the 1st iteration S[0] must be swapped with S[1] giving: S = [1 0 2 3 4 5 6 7]
IEEE 802.11 i = 1 j = 3 Swap(S[1],S[3]) S = [1 3 2 0 4 5 6 7]; i = 2 j = 0 Swap(S[2],S[0]) S = [2 3 1 0 4 5 6 7] i = 3 j = 6 Swap(S[3],S[6]) S = [2 3 1 6 4 5 0 7];
IEEE 802.11 What is the result of the last iteration ( I = 7)?
IEEE 802.11 Pseudo random generation algorithm S = [2 3 7 4 6 0 1 5] i = (0 + 1) mod 8 = 1 j = (0 + S[1]) mod 8 = 3 Swap(S[1],S[3]) S = [2 4 7 3 6 0 1 5] t = (S[1] + S[3]) mod 8 = 7 k = S[7] = 5 Remember, that P is: P = [1 2 2 2] So our rest 3-bits of ciphertext is obtained by: k XOR P1 5 XOR 1 = 101 XOR 001 = 100 = 4
IEEE 802.11 Pseudo random generation algorithm S = [2 4 7 3 6 0 1 5] i = (1 + 1 ) mod 8 = 2 j = (3 + S[2]) mod 8 = 2 Swap(S[2],S[2]) S = [2 4 7 3 6 0 1 5] t = (S[2] + S[2]) mod 8 = 6 k = S[6] = 1 Second 3-bits of ciphertext are: 1 XOR 2 = 001 XOR 010 = 011 = 3
IEEE 802.11 What is the result of the last iteration?
IEEE 802.11 Practical security solutions Service Set Identifier (SSID) is a unique identifier attached to the header of packets sent over a WLAN that acts as a password when a mobile device tries to connect to a particular WLAN. The SSID differentiates one WLAN from another, so all access points and all devices attempting to connect to a specific WLAN must use the same SSID. In fact, it is the only security mechanism that the access point requires to enable association in the absence of activating optional security features.
IEEE 802.11 Not changing the default SSID is one of the most common security mistakes made by WLAN administrators. This is equivalent to leaving a default password in place.
Authentication types for wireless networks Open authentication: IEEE 802.11 Allows any device to authenticate and then attempt to communicate with the access point. Using open authentication, any wireless device can authenticate with the access point, but the device can communicate only if its Wired Equivalent Privacy (WEP) keys match the access point s WEP keys. Devices that are not using WEP do not attempt to authenticate with an access point that is using WEP.
IEEE 802.11 The device s WEP key does not match the access point s key. Therefore, the device can authenticate but not pass data.
Authentication types for wireless networks: Shared key authentication: IEEE 802.11 During shared key authentication, the access point sends an unencrypted challenge text string to any device that is attempting to communicate with the access point. The device that is requesting authentication encrypts the challenge text and sends it back to the access point. If the challenge text is encrypted correctly, the access point allows the requesting device to authenticate.
IEEE 802.11
Authentication types for wireless networks: EAP authentication: IEEE 802.11 By using the Extensible Authentication Protocol (EAP) to interact with an EAP-compatible RADIUS server, the access point helps a wireless client device and the RADIUS server to perform mutual authentication. The radius server sends an authentication challenge to the client. The client uses a one-way encryption of the user-supplied password to generate a response to the challenge and sends that response to the RADIUS server.
Authentication types for wireless networks: EAP authentication: IEEE 802.11 Using information from its user database, the RADIUS server creates its own response and compares that to the response from the client. When the RADIUS server authenticates the client, the process repeats in reverse, and the client authenticates the RADIUS server. When mutual authentication is complete, the RADIUS server and the client determine a WEP key that is unique to the client and that provides the client with the appropriate level of network security.
IEEE 802.11 Authentication types for wireless networks:
Authentication types for wireless networks: MAC authentication: IEEE 802.11 We can create a list of allowed MAC addresses on the access point s. Devices with MAC addresses not on the list are not allowed to authenticate.
IEEE 802.11