CMC3P22-P03-1005827I

difference between 802.11k, 802.11i, 802.11r and 802.11w
IEEE 802.11i
Data Frames
802.11i encrypts the whole data frame with AES. AES stands for Advance Encryption Standard. AES supports key length of up to 256 bits, but not compatible with older hardware. It also supports stronger encryption than WPA/TKIP.


How does it work


1. The wireless client and the AP engage in an exchange to determine the security capabilities of the two devices. If the wireless client and AP are not IEEE 802.11i or Wi-Fi Protected Access (WPA) version 2 capable, they fall back to WEP.
2. If both are IEEE 802.11i capable, the wireless client enters the second phase and engages in an authentication procedure. It first establishes an Extensible Authentication Protocol over LAN (EAPOL) connection to the AP, and the AP in turn establishes a RADIUS connection to the authentication server. At this point the AP becomes nothing more than a relay, ensuring that the traffic being passed on to the RADIUS server is indeed coming from the initial client. Over these two connections, the wireless device and the RADIUS server establish a Transport Level Security (TLS) tunnel, where the client is challenged for its authentication credentials and is authenticated by the RADIUS server. The two systems then independently generate an identical, large, pseudo-random number known as the pairwise master key (PMK) which represents the authenticated relationship.
3. The RADIUS server distributes this key to the AP.
4. Now that the AP and the wireless client have a shared master key, they use the PMK to derive a set of three keys collectively called the pairwise transient key (PTK). The PMK derived earlier is never used to actually encrypt data, and is never conveyed across the wireless link. This provides it with protection against attack. The keys derived from the PMK, however, are used to manage key distribution and to encrypt data.
5. The wireless client and the AP would then secure the data that they have just exchanged




802.11r


Data frames
The 802.11r standard applies to a 3-tier reference architecture that divides the access network into mobility zones. A mobility zone is defined as the collection of lightweight access points connected to a central management unit, referred to as a controller. In general, neighboring access points covering a certain geographic zone are grouped into a single mobility zone.
When an 802.11r compliant station enters a mobility zone, it first performs authentication using EAP. The resulting MSK is used by the station and the controller to derive a key called PMK-R0. PMK-R0 is then used to derive per-access-point PMKs. The name for such keys is PMK-R1. The controller finally sends the PMK-R1 keys to their corresponding access points. The mobility zone controller that holds the PMK-R0 key is called R0 Key Holder (R0KH), while the access points to which PMK-R1 keys are delivered are R1 Key Holder (R1KH).
The key structure specified by the IEEE 802.11r standard is shown in the figure below.





How does it connects



802.11k


Data FramesThe data frame request/report pair returns a picture of all the channel traffic and a count of all the frames received at the measuring STA. For each unique Transmitter Address, the STA reports the Transmitter Address, number of frames received from this transmitter, average power level (RCPI) for these frames, and BSSID of the transmitter.

How does it works






802.11w


Data frames
The IEEE 802.11w standard aims to avoid certain types of WLAN DoS attacks. 802.11w extends strong cryptographic protection to specific management frames (in a manner that is similar to what 802.11i/RSN defines for data frames). A select set of management frames transmitted after 802.11i/RSN key derivation is protected. MFP is provided for a category of management frames called “Robust Management Frames”. Deauthentication frames, Disassociation frames, and certain categories of Action Management frames are defined as Robust Management Frames. Action Management Frames are special types of management frames that carry WLAN operation related information – e.g., QoS Management, Spectrum Management or BlockAck session management.



References:
http://www.tech-faq.com/80211i.html
http://csrc.nist.gov/archive/wireless/S10_802.11i%20Overview-jw1.pdf

http://www.eetimes.com/discussion/other/4025006/IEEE-802-11i-and-wireless-security
http://www.networkworld.com/details/7559.html
http://www.networkworld.com/graphics/2005/0822tu.gif
http://www.networkworld.com/news/tech/2005/082205techupdate.html
http://www.codealias.info/_media/technotes/80211r-key.jpeg?w=450&h=&cache=cache
http://www.intel.com/standards/case/case_802_11.htm
http://www.networkworld.com/news/tech/2004/0329techupdate.html
http://www.networkworld.com/graphics/2004/0329tu.gif
http://www.networkworld.com/columnists/2006/052906-wireless-security.html
http://www.cwnp.com/cwnp_wifi_blog/wireless-lan-security-and-ieee-802-11w
http://www.hill2dot0.com/wiki/index.php?title=802.11i
http://www.windowsecurity.com/articles/80211i-wpa-rsn-wi-fi-security.html
http://www.codealias.info/technotes/the_ieee_802.11r_standard_for_fast_wireless_handoffs
http://ux.brookdalecc.edu/fac/engtech/mqaissaunee/netw125/student%20presentations/Brian%20Carey%20IEEE%20802.11r.pdf
www.cs.tut.fi/~83180/83180_05_S11b.ppt
http://voiplab.niu.edu.tw/IEEE/802.11/802.11k-2008.pdfhttp://www.cwnp.com/cwnp_wifi_blog/wireless-lan-security-and-ieee-802-

11w

X.500 Security Feature

X.500 is a standard developed by ITU-T and partnered by ISO, the standards is on electronic directory services, it was developed to the requirements of X.400 and for storing information about objects, such as organizations, persons, distribution lists, groups, certification authorities, etc.

This standard provides a structure model protocols for inter-directory communication between different systems and this allows directory information of each servers in the network to be distributed.

There are a number of protocols defined by X.500, it includes:
DAP (Directory Access Protocol)
DSP (Directory System Protocol)
DISP (Directory Information Shadowing Protocol)
DOP (Directory Operational Bindings Management Protocol)

These standards was developed with the reference to the OSI model and to allow clients from the internet to access x.500 using TCP/IP, LDAP was created as a alternative for DAP

The primary concept of X.500 is that there is a single Directory Information Tree (DIT), a hierarchical organization of entries which is distributed across one or more servers, called Directory System Agents (DSA). An entry consists of a set of attributes, each attribute with one or more values. Each entry has a unique Distinguished Name, formed by combining its Relative Distinguished Name (RDN), one or more attributes of the entry itself, and the RDNs of each of the superior entries up to the root of the DIT. As LDAP implements a very similar data model to that of X.500, Security

http://www.x500standard.com/index.php?n=X500.X500

Microsoft’s Active Directory Security Feature

Active directory is directory service created by microsoft for domain model network in windows servers operating system.

Active Directory serves as a central location for network administration and security. It is responsible for authenticating and authorizing all users and computers within a network of Windows domain type, assigning and enforcing security policies for all computers in a network and installing or updating software on network computers.

This standard also uses LDAP like the X.500 standard, DNS and kerberos

In Active directory, security is enforced using trust inside the domain structure

One-way trust

One domain allows access to users on another domain, but the other domain does not allow access to users on the first domain.

Two-way trust
Two domains allow access to users on both domains.

Trusting domain
The domain that allows access to users from a trusted domain.

Trusted domain
The domain that is trusted; whose users have access to the trusting domain.

Transitive trust
A trust that can extend beyond two domains to other trusted domains in the forest.

Intransitive trust
A one way trust that does not extend beyond two domains.

Explicit trust
A trust that an admin creates. It is not transitive and is one way only.

Cross-link trust
An explicit trust between domains in different trees or in the same tree when a descendant/ancestor (child/parent) relationship does not exist between the two domains.

Shortcut
Joins two domains in different trees, transitive, one- or two-way

Forest
Applies to the entire forest. Transitive, one- or two-way

Realm
Can be transitive or nontransitive, one- or two-way

External
Connect to other forests or non-AD domains. Nontransitive, one- or two-way

LDAP Security Feature

LDAP aka Lightweight Directory Access Protocol is a application protocol specified by IETF to use for accessing and distribute directory service data over the internet using the TCP/IP model



With such a concentration of data in the directory, security becomes very important. Anyone who could modify the data could give themselves access to vast numbers of machines at a stroke. Some data needs to be protected from unauthorised viewing: although all passwords are hashed, anyone who can read the hashes can mount a dictionary attack. More subtly, anyone who can hijack a client-server connection can feed bogus data to an individual client, or use the client's privileges to modify server data. All these things can be protected against, and LDAP now has most of the tools needed to do it.

Access control list
Control over who may read what and who may change what is exercised with Access Control Lists (ACLs).

Client authentication
The simplest form of client authentication is to bind to the server using a cleartext password. This is the method normally used by pam_ldap for checking login passwords. For security, this method should only be used with encrypted connections.

A more secure method is to use one of the SASL authentication mechanisms, such as DIGEST-MD5[4]. This is based on a secret known to both the client and the server, allowing for a simple challenge-response scheme. SASL is also capable of negotiating data encryption to protect subsequent operations.

LDAP also supports encryption and authentication using Transport Layer Security[5]. TLS is closely related to the older SSL scheme, and uses the same certificate-based methods. In its simplest form, TLS provides proof of server identity and protection of data in transit so it is useful where plaintext passwords might be passed across the net. The same mechanism can also be used to prove the identity of the client to the server, where the client has been issued with a suitable X.509 certificate.

http://www.skills-1st.co.uk/papers/security-with-ldap-jan-2002/security-with-ldap.html

GPRS Security Feature, Threats and Solution

GPRS (General Packet Radio Service) is a mobile data service standard for the GSM cellular network, it was started by ETSI but now it is maintained by 3GPP. By using time division multiple access (TDMA), this standard can provie moderate speed up to 114 kbit/second data transfer. 

A topology map of a cellular system, GPRS resides in the IP packet switched data network.

As seen in the topology map above, GPRS is normally deployed with a voice network in order to provide both voice service and internet services to base stations.


GPRS features
GPRS extends the GSM Packet circuit switched data capabilities and makes the following services possible:

• SMS messaging and broadcasting
• "Always on" internet access
• Multimedia messaging service (MMS)
• Push to talk over cellular (PoC)
• Instant messaging and presence—wireless village
• Internet applications for smart devices through wireless application protocol (WAP)
• Point-to-point (P2P) service: inter-networking with the Internet (IP)
• Point-to-Multipoint (P2M) service: point-to-multipoint multicast and point-to-multipoint group calls

http://en.wikipedia.org/wiki/General_Packet_Radio_Service#Services_offered

GPRS Threats

Security Threats in GPRS systems

• Denial of Service (DOS)
• A particular victim Mobile host gets terminated
• Malicious party gets to see all traffic directed to particular Mobile host
• Session Stealing/Spoofing
• Eavesdropping and floods the Mobile host with bogus traffic
• Intercepting packets destined to Mobile host
• Incompetent Translator
• Attacker gains physical access via unattended network socket by exercising
• some ARP requests to DHCP and gets access to IP host and floods the network
• Simple attack through Intranet to GGSN's Gi interface
• Attack through GPRS Tunneling Protocol (GTP)

GSM Security Feature, Threats and Solution

Global System for Mobile communication (GSM) standardized by ETSI is a widely used digital mobile telephone system mainly in Europe but also in other parts of the world. GSM technology uses the Time Division Multiple Access (TDMA) technique to digitize data and compress it, and send data using 2 channels. GSM operates in the 900MHz, 1800MHz, or 1900Mhz frequency bands, but in Singapore our telcos only uses the 900MHz and 1800Mhz band.

http://allworldcellphones.com/gsm-frequencies-list.htm

                             The GSM logo is used to identify compatible handsets and equipment

 Security threats
Eavesdropping
The capability of an intruder to intercept traffic and
signaling information associated to other users. The
required equipment is a modified mobile phone.

Impersonation of a user
This is the capability of sending rogue data and/or
signaling messages to the network with the intent of
making them appear from another user. This again only
requires a modified mobile phone.

Impersonation of the network
This is the capability of sending rogue data and/or
signaling messages to another user with the intent of
making them appear from a genuine network. This
requires a modified BTS.

MITM – Man-In-The-MiddleThis is the capability of an attacker to put itself between
the network and the legitimate user in order to eavesdrop,
modify, delete, re-order, re-play and spoof signaling data
between the two parties. This requires a modified BTS in
conjunction with a modified mobile phone.

Network Authentication Compromise
The intruder possesses a compromised authentication
vector (challenge-response pairs, cipher keys, integrity
keys, etc.)

 Security features

The GSM standard provides  a number of security features that solves some of the security flaws

Authenticationnetwork operator can verify the identity of the subscriber
making it infeasible to clone someone else’s mobile phone

Confidentialityprotects voice, data and sensitive signalling information (e.g.
dialled digits) against eavesdropping on the radio path

Anonymity
protects against someone tracking the location of the user or
identifying calls made to or from the user by eavesdropping on
the radio path