Compare IEEE 802.11i, IEEE 802.11r, IEEE 802.11k and IEEE 802.11w

802.11i

1.Temporal Key Integrity Protocol (TKIP): a data-confidentiality protocol that was designed to improve the security of products that implemented WEP. TKIP uses a message integrity code called Michael, which enables devices to authenticate that the packets are coming from the claimed source. Also TKIP uses a mixing function to defeat weak-key attacks, which enabled attackers to decrypt traffic.

2. Counter-Mode/CBC-MAC Protocol (CCMP): a data-confidentiality protocol that handles packet authentication as well as encryption. For confidentiality, CCMP uses AES in counter mode. For authentication and integrity, CCMP uses Cipher Block Chaining Message Authentication Code (CBC-MAC). In IEEE 802.11i, CCMP uses a 128-bit key. CCMP protects some fields that aren't encrypted. The additional parts of the IEEE 802.11 frame that get protected are known as additional authentication data (AAD). AAD includes the packets source and destination and protects against attackers replaying packets to different destinations.

3.IEEE 802.1x: offers an effective framework for authenticating and controlling user traffic to a protected network, as well as dynamically varying encryption keys. 802.1X ties a protocol called EAP (Extensible Authentication Protocol) to both the wired and wireless LAN media and supports multiple authentication methods.




4. EAP encapsulation over LANs (EAPOL)– it is the key protocol in IEEE 802.1x for key exchange. Two main EAPOL-key exchanges are defined in IEEE 802.11i. The first is referred to as the 4-way handshake and the second is the group key handshake.





This is the key hierarchy specified by the IEEE 802.11r standard.

The 802.11r standard applies to a 3-tier reference architecture that divides the access network into mobility zones. A mobility zone is defined as the collection of lightweight access points connected to a central management unit, here after referred to as controller. Generally, neighboring access points covering a certain geographic zone are grouped into a single mobility zone.When a 802.11r compliant station enters a mobility zone, it first performs authentication using EAP. The resulting MSK is used by the station and the controller to derive a key called PMK-R0. PMK-R0 is then used to derive per-access-point PMKs. The name for such keys is PMK-R1. The controller finally sends the PMK-R1 keys to their corresponding access points. The mobility zone controller that holds the PMK-R0 key is called R0 Key Holder (R0KH), while the access points to which PMK-R1 keys are delivered are R1 Key Holder(R1KH).

802.11k

A proposed IEEE standard, 802.11k aims to provide key client feedback to
wireless-LAN access points and switches. The proposed standard defines a series
of measurement requests and reports that detail Layer 1 and Layer 2 client
statistics. In most cases, access points or WLAN switches ask clients to report
data, but in some cases clients might request data from access points.

Because 802.11k is designed to be implemented in software, existing WLAN
equipment can be upgraded to support it. For the standard to be effective, both
clients (WLAN cards and adapters) and infrastructure (access points and WLAN
switches) will need to support it.
Here are some of the measurements 802.11k defines:
• Roaming decisions.• RF channel knowledge.• Hidden nodes.•
Client statistics.• Transmit Power Control (TCP).

802.11w

Protected Management Frames

Current 802.11 standard defines "frame" types for use in management and control of wireless links. IEEE 802.11w is the Protected Management Frames standard for the IEEE 802.11 family of standards. TGw is working on improving the IEEE 802.11 Medium Access Control layer. The objective of this is to increase the security by providing data confidentiality of management frames, mechanisms that enable data integrity, data origin authenticity, and replay protection. These extensions will have interactions with IEEE 802.11r and IEEE 802.11u

Wireless LANs send system management information in unprotected frames, which makes them vulnerable. This standard will protect against network disruption caused by malicious systems that forge disassociation requests that appear to be sent by valid equipment.



The above picture is a connection diagram.

Microsoft’s Active Directory Security Feature

Security Features

Delegation Of Control wizard

Administrators must be able to protect their directory from attackers and users, while delegating tasks to other administrators where necessary. This is all possible using the Active Directory security model, which associates an access control list (ACL) with each container, object, and object attribute within the directory.


This high level of control allows an administrator to grant individual users and groups varying levels of permissions for objects and their properties. Administrators can even add attributes to objects and hide those attributes from certain groups of users. Nonmanagers would not even know that the attribute existed.


A concept new to Windows 2000 Server is delegated administration. This allows administrators to assign administrative tasks to other users, while not granting those users more power than necessary. Delegated administration can be assigned over specific objects or contiguous subtrees of a directory. This is a much more effective method of giving authority over the networks; rather than granting someone the all powerful Domain Administrator permissions, he or she can be given permissions for just those systems and users within a specific subtree. Active Directory supports inheritance, so any new objects inherit the ACL of their container.


There is no distinction between one-way and two-way trusts because all Active Directory trusts are bidirectional. Further, all trusts are transitive. So, if Domain A trusts Domain B, and Domain B trusts Domain C, then there is an automatic implicit trust between Domain A and Domain C.

Windows 2000 Server trusts are bidirectional and transitive.

Another Active Directory security feature is auditing. Just as you can audit NTFS partitions, objects and containers within Active Directory can be audited. This is a useful way to determine who is attempting to access objects, and whether or not they succeed.

LDAP Security Feature

Security Perspective

LDAP Security Feature

Access Control
Control over who may read what and who may change what is exercised with Access Control Lists (ACLs). This is one of the non-standardised areas of LDAP, and it varies a lot from one server to another.

Client Authentication
The simplest form of client authentication is to bind to the server using a cleartext password. This is the method normally used by pam_ldap for checking login passwords. For security, this method should only be used with encrypted connections.

X.500 Security Feature

What is X.500?
X.500 is an ISO (International Standards Organization) standard distributed directory system that's sometimes seen as a "competitor" to DNS

Featureas and functions X.500

• X.500 can be use to retrieve address information for a particular host
  


• X.500, as a directory service, supports many types of searching



• X.500 is a full-blown distributed database meant to be used for a wide variety of applications

You can store the phone book in an X.500 database. You can store location data in an X.500 database. You can store information about all sorts of network devices and their attributes.

• X.500 has security features involving credentials and the support of multiple encryption types

GPRS Security Feature, Threats and Solution

What is GPRS?

GPRS stands for General Packet Radio Service. It is a wireless data service that extends GSM data capabilities for Internet access, multimedia messaging services, and early mobile Internet applications via the wireless application protocol (WAP), as well as other wireless data services.

GPRS system architecture

GPRS Security Feature
Security services are protections and assurances that provide mitigation against various threats. They are generally known as:

• Integrity: Integrity is a security service that assures that data cannot be altered in an unauthorized or malicious manner.
  



• Confidentiality: Confidentiality is the protection of data from disclosure to unauthorized third parties.
  



• Authentication: Authentication provides assurance that a party in data communication is who or what they claim to be.
  



• Authorization: Authorization is a security service that ensures that a party may only perform the actions that they’re allowed to perform.
  



• Availability: Availability means that data services are usable by the appropriate parties in the manner intended.
  
  

GPRS Threats and Solution

• Subscriber Identity Confidentiality
  It may lead an active attacker to pretend to be a new serving network, to which the user has to reveal his permanent identity.
  


• Subscriber Authentication
  The authentication procedure is one-way, and, thus, it does not assure that a mobile user is connected to an authentic serving network. This fact enables active attacks using a false base station identity.
  


• Data and Signalling Protection
  An important weakness of the GPRS security architecture is related to the fact that the encryption of signalling and user data over the highly exposed radio interface is not mandatory. Causing signalling and data traffic are conveyed in clear-text over the radio path.

Let's look at the solution.

• Identity Confidentiality
  To limit the exposure of the permanent identities (IMSI) of mobile users over the vulnerable radio interface, the additional usage of two complementary temporary identities for each mobile subscriber that is attached to the network has been proposed
  



• Signalling Protection
  To address the lack of security measures in the signalling plane of the GPRS backbone, we propose the incorporation of the Network Domain Security (NDS) features into the GPRS security architecture. NDS features, which have been designed for the latter version of UMTS, ensure that signalling exchanges in the backbone network, as well as in the whole wire line network are protected.

Reference

netscreen.com

GSM Security Feature, Threats and Solution

What is GSM?

GSM stands for Global System for Mobile Communications. It is a standard set developed by the European Telecommunications Standards Institute (ETSI) to describe technologies for second generation (2G) digital cellular networks.















GSM Security Feature

Security in GSM consists of the following aspects: subscriber identity authentication, subscriber identity confidentiality, and user and signaling data confidentiality.

• Subscriber identity authentication
  It uses a challenge response protocol for which the fixed network authenticates the identity of mobile subscribers.
  


• Subscriber identity confidentiality
  Subscriber identity confidentiality means that the operator tries to protect the user’s telephone number from unauthorized tapping, such that information is disclosed only to those who are authorized to view it.
  


• User and signaling data confidentiality
  Signalling and data channels are protected over the radio path. Privacy of user-generated data is provided for both voice and non-voice transferred over the radio path on traffic channels. Privacy for user data transferred in packet mode over the radio path on dedicated signaling channels is also provided. Encrypted voice and data communication between the MS (Mobile Station) and the network is achieved through the ciphering algorithm A5.
  

GSM Threats and Solution



The table above summarizes the threats and their ranks. It is easily observable that the most serious threat is the denial of service attack.

So what are the solution to these problems?

• Use secure algorithms for A3/A8 implementations
  This can thwart the dangerous SIMcard cloning attack
  


• Use secure ciphering algorithms
  Operators can use newer and more secure algorithms such as A5/3 provided that such improvements are allowed by the GSM consortium.
  


• Securing the backbone traffic
  Encrypting the backbone traffic between the network components can prevent the attacker to eavesdrop or modify the transmitted data.
  


• End-to-end security
  The best, easiest, and most profitable solution is to deploy the end-to-end security or security at the application layer.
  

Reference

Academia.edu

VTT Research Notes