WiFi Security Protocol

security에는 크게 암호화 기법과, 인증 기법이 있으며 이를 잘 파악해야 할듯..

WEP(Wired Equivalent Privacy)

- WEP-40: 24bit 의 IV(Initialization Vector)와 40bit으로 구성된 key를 사용(so called WEP-40)

     40 bits are used for encryption

- WEP-104: 24 bit의 IV와 104 bit으로 구성된 key사용

- Authentication(2가지 인증 방식)

  .Open System Authentication

사실상 인증 작업을 필요로 하지 않는 association 기법

client가 right key를 가지고 있기만 하다면 association 가능

  .Shared Key Authentication

1) client가 AP에게 인증요청을 보내고

2) AP가 clear-text challenge를 send back to client.

3) client가 AP로부터 받은 challenge text를 configured WEP key를 이용하여 암호화하고

    이를 다시 인증요청에 포함하여 AP에 재전송

4) AP는 받은 것을 해독하여, 처음에 보낸 clear challenge text와 비교해보고

    그 결과에 따라 positive or negative response를 send back한다.

- Encryption: RC4 key stream XORed with plaintext.

WPA(WiFi Protected Access)

- WEP방식에서 발견된 여러가지 security weakness를 보완하기 위해 등장

- Authentication

  .PSK(Pre-Shared Key)

  .EAP(Extensible Authentication Protocol)

- Encryption

   암호화 기법으로 TKIP(Temporal Key Integrity Protocol)을 사용하며...

   The TKIP encryption algorithm is stronger than the one used by WEP

WPA2

- WPA를 보완

- WPA2-Personal과 WPA2-Enterprise의 두 종류가 있음

- Authenticatoin

  .WPA2-Personal에서는 PSK방식을 사용

   "Pre-shared key mode (PSK, also known as Personal mode) is designed for home and

      small office networks that don't require the complexity of an 802.1X authentication server."

    .WPA2-Enterprise에서는 EAP방식을 사용

- Encryption

   암호화 기법으로는 CCMP althorithm사용

   (AES based algorithm으로, 혹자는 AES를 WPA2의 encryption algorithm이라 하기도 함)

            AES: Advanced Encryption Standard

암호화 방식에 따라..(2010.08.04)

 - stream cipher

   1) WEP

   2) TKIP - enhanced than WEP

 - Block cipher

   AES - one of CCMP(?), 이건 위에 언급한 내용이랑 좀 다른데....?????

WiFi Protected Setup

this is from Wikipedia

 - PBC stands for 'Push Button Configuration'.

Wi-Fi Protected Setup (WPS) is a standard for easy and secure establishment of a wireless home network, created by the Wi-Fi Alliance and officially launched on January 8, 2007.

The standard achieves its goal by putting much emphasis into usability and security, and the concept is implemented through four usage models that enable a user to establish a home network. So, to add a new device to the Network the user can have up to the following four choices:

1. PIN method, in which a PIN (Personal Identification Number) has to be read from either a sticker on the new wireless client device (STA) or a display, if there is one, and entered at the "representant" of the Network, either the wireless access point (AP) or a Registrar of the Network, cf below the Protocol Architecture.

   This is the mandatory baseline model, every Wi-Fi Protected Setup certified product must support it.

2. PBC method, in which the user simply has to push a button, either an actual or virtual one, on both the AP (or a Registrar of the Network) and the new wireless client device (STA).

   Support of this model is mandatory for APs and optional for STAs.

3. NFC method, in which the user simply has to bring the new STA close to the AP or Registrar of the Network to allow near field communicationbetween the devices. NFC Forum compliant RFID tags can also be used.

   Support of this model is optional.

4. USB Method, in which the user uses a USB flash drive to transfer data between the new STA and the AP or Registrar of the Network.

   Support of this model is optional.

The last two models are usually referred as out-of-band methods as there is a transfer of information by another channel than the Wi-Fi channel itself.

Note that only the first three models (PIN/PBC/NFC) are currently covered by the Wi-Fi Protected Setup Certification and there is so far no intention to certify the USB method.

This page addresses the common scenario involving an Infrastructure Network. The support of ad hoc networks (IBSS) are not supported by WPS.

Protocol Architecture

The WPS protocol defines three types of devices in a network:

• Registrar: A device with the authority to issue and revoke credentials to a network. A Registrar may be integrated into an AP, or it may be separate from the AP.
• Enrollee: A device seeking to join a wireless LAN network.
• Authenticator: An AP functioning as a proxy between a Registrar and an Enrollee.

The WPS standard defines three basic scenarios that involve these components:

1. AP with internal registrar capabilities configures an Enrollee STA. In this case, the session will run on the wireless medium as a series ofEAP request/response messages, ending with the AP disassociating from the STA and waiting for the STA to reconnect with its new configuration (handed to it by the AP just before).
2. Registrar STA configures the AP as an Enrollee. This case is subdivided in two aspects: first the session could occur on both a wired or wireless medium, and second the AP could already be configured by the time the Registrar found it. In the case of a wired connection between the devices, the protocol runs over UPnP, and both devices will have to support UPnP for that purpose. When running over UPnP, a shortened version of the protocol is run (only 2 messages) as no authentication is required other than that of the joined wired medium. In the case of a wireless medium, the session of the protocol is very similar to the internal registrar scenario, just with opposite roles. As to the configuration state of the AP, the registrar is expected to ask the user whether to reconfigure the AP or keep its current settings, and can decide to reconfigure it even if the AP describes itself as configured. Multiple registrars should have the ability to connect to the AP.
3. Registrar STA configures Enrollee STA. In this case the AP stands in the middle and acts as an Authenticator, meaning it only proxies the relevant messages from side to side.

It should be noted that UPnP is regarded to only apply to a wired medium, while actually it applies to any interface that an IP connection can be set up on. Meaning that after manually setting up a wireless connection, the UPnP can be used over the wireless medium in the same manner as with the wired.

Protocol Structure

The WPS protocol itself consists as a series of EAP message exchanges that are triggered by a user action annge of descriptive information that should precede that user's action.

The descriptive information is transferred through a new IE that's added to the Beacon, Probe Response and optionally to the Probe Request and Association Request/Response messages. Other than purely informative TLVs, those IEs will also hold the possible, and the

After the identification of the device's capabilities on both ends, a human trigger is to initiate the actual session of the protocol. The session consists of 8 messages, that are followed in the case of a successful session by a message to indicate the protocol is done. The exact stream of messages may change when configuring different kinds of devices (AP or STA) or using different physical media (wired or wireless).

Beacon, WiFi

What the hell is a Beacon?

명사

1.(안전 운행을 유도하는) 신호등[불빛]  Belisha beacon

a navigation beacon

운행 신호등

He was a beacon of hope for the younger generation.

그는 젊은 세대에게 희망의 불빛이었다.

2.(배・비행기의 위치 확인을 돕는) 무선 송신소

3.(과거 신호용으로 피워 올리던) 봉화

Network 규격에서 Tx와 Rx사이의 미리 약속된, 알고 있는 신호를 의미한다.

즉, Tx에서 보내는 data를 Rx에서 이미 알고 있으므로 동기화 및 channel estimation등의 용도로 사용된다.

Beacon은 AP에서 전송되는 신호이다.

AP의 존재와 지원능력(SSID, Signal strength, 사용가능한 datarate..)을

주변 무선기기에 주기적으로 알려준다.(broadcasting)

무선 client는 이 beacon을 받아서 AP와 시간을 동기화 시키고

Power save mode로 동작할 수 있도록 해준다.

Beacon Interval 은 AP가 beacon message를 전송하는 interval을 의미한다.