Network Coordination
A Wi-Fi LAN needs to be coordinated at many levels. At the
lowest levels the IEEE 802.11 standard specifies procedures to synchronize
timing and avoid multiple devices transmitting at the same time. At higher
levels there are procedures to enable smooth joining and exiting from the
network. We are interested in these higher-level procedures because they impact
on the security operations.
ESS Versus IBSS
Most Wi-Fi LAN systems are organized with one or more access
points and a number of clients. A typical home installation has one access point
and two or three clients. A large corporate network might have hundreds of
access points and thousands of clients. In IEEE 802.11, networks of this type
are called infrastructure mode or ESS networks.
IEEE 802.11 also supports a mode called ad-hoc
or IBSS network. The significant difference is that in IBSS mode, there is no
access point and any mobile device can talk to any other directly. On the face
of it, IBSS is simpler and more efficient for small networks but creates
management problems because no one device is in control.
As we described in Chapter 5, both types of networks are
controlled using management messages that are independent of the actual data
being passed from device to device. The management and control messages allow
the network to share the available transmission time efficiently and also enable
the access point to exercise control of the network. For a review of the types
of messages used, look again at Chapter 5.
From an architectural point of view, IBSS presents quite a few
problems for security. If you have an access point, you can give that access
point the responsibility for checking the credentials of new devices and,
because all the data must pass through, it can effectively block unwelcome
devices. However, in the IBSS case you cannot enforce effective controls because
any device can talk to any other. We come back to this issue later in the
chapter. For now, though, let's review the procedures and messages that allow
the access point to maintain control in an ESS network.
Joining an ESS Network
The original IEEE 802.11 required that a new mobile device (an
aspirant device) must pass two phases before being allowed to join the network.
The first phase is an authentication exchange whereby the aspirant device is
supposed to prove its credentials to the access point. We now know that the
original method was very insecure, but the basic idea was to block any unwanted
devices by rejecting them at an early stage. If an aspirant device passes the
authentication phase it is then required to associate to the access point. The
process of association is intended to check that the capabilities of the device
and the access point are compatible and negotiate some of the variable
parameters such as data rate. Once a device is associated, it must send all its
data frames to the access point, which will then be responsible for forwarding
the data on to its destination.
If the device decides to move to another access point, perhaps
for better signal strength, it is required to dissociate from the current access
point before associating with the new one. No device can be associated with two
access points at the same time. By contrast, in the original IEEE 802.11
standard, it is acceptable to authenticate with another access point in advance,
to reduce time during the handover.
In RSN/WPA we cannot use so simple a system. RSN/WPA is based
on IEEE 802.1X and EAP. From the point of view of IEEE 802.11, EAP messages are
not management or control frames. They do not belong to IEEE 802.11 and are
therefore treated like ordinary data frames. Before we can even start the IEEE
802.1X process, an aspirant device must already be connected (in other words,
associated) with the access point. This turns the process of joining on its head
because it means that association must be done before authentication! The
network is protected by blocking data until the IEEE 802.1X and key handshakes
have occurred.
For WPA/RSN the management messages that are used for
authentication in the older systems are still used, but they play no part in
security. However, the management messages for association still have an
important role and are used in negotiating the security method to be used. To
see how this is done, let's quickly review the message sequences.
The access point sends out beacon messages, usually about ten
times a second. The beacons include information about the capabilities of the
access point and also serve as a timing reference for some of the protocol
operations such as power saving modes. Here we are concerned with the ability of
the beacons to advertise capabilities. The items to be advertised include things
like the network name or SSID, the supported data rates, and so on.
When a mobile device is looking for an access point with which
to connect, it can listen on each radio channel for beacons or it can speed
things up by issuing a probe request that basically says, "Is anybody there?" An
access point receiving the request can reply immediately with a probe response,
essentially with the same information as a beacon. This process allows a new
mobile device to scan around quickly and find the access points available. It
also allows a connected device to keep one eye open for other access points with
better signal strength that might be candidates for roaming.
Once a device has identified a target access point, it attempts
to pass the two stages of authentication and association. For WPA/RSN, the
access point allows open authentication. This
simply means that the authentication exchange is two messages:
No actual authentication is performed; it is just a null
process.
The second part is more important. The device sends an
association request to the access point. This tells the access point about the
capabilities of the device and also specifies which capabilities of the access
point the device wants to use. Assuming the access point finds these acceptable,
it generally sends an association response, allowing the device to join the
network. In the case of RSN and WPA, the device must then complete the IEEE
802.1X procedure and the pairwise key handshake before sending data.
Sections
Archive
Syndication
