©Antti Siitonen, 2001 · Security › IEEE 802.11 provides two security methods » Authentication » Open System » All stations may request authentication » Authentication can

119.11.2001©Antti Siitonen, 2001

WLAN

Antti Siitonen

Technologist MSc (EE), Radiolinja

[email protected]

› T-110.300 Telecommunications architectures

› Lectures on 21.11.2001

› WLAN overview

2

Contents

›WLAN basics»Basics»Protocols»Standards @ 2,4 GHz»Network and Radio properties»Terminals»Security»Development»Roaming»Business models»Future

3

WLAN-basics› Current WLAN solutions are mainly based on IEEE 802.11standards and they implement ETHERNET over wirelessMedia

› Focus on OSI layers 1 & 2

› Bandwidth 1-11 Mbit/s› IEEE 802.11 - 1 or 2 Mbit/s

› IEEE 802.11b - 1, 2, 5.5 and 11 Mbit/s

› Network architecture can be› Ad hoc (spontaneus)

› Infrastructure network

Physical

Data Link

Network

Transport

Session

Presentation

Application

©Antti Siitonen, 2001

IPX (Novell)IP (Internet Protocol)

Data Link

Network

Physical

Application

Transport TCP UDP

SessionPresentation

NCP

NetWareXWindows

SNMP

SPX

TelnetFTP

RIP

WebBrowsers

EMAIL

NDSNFS

Net Management

NetBEUI(Microsoft)

SMB

2.4 GHz11 Mbps DSSS

Possible proprietary protcolsPossible proprietary protcols

IEEE 802.11WLAN MAC

IAPP

ProprietaryMANAGEMENT

2.4 GHz2 Mbps FHSS

5 GHz54 Mbps OFDM

Wireless LAN Protocols

5

WLAN - Plain Wireless Ethernet Extension

802.11WLANradio

Bridge control

802.11WLANradio

EthernetOtherLAN

interfaceEthernet Ethernet

Applications ApplicationApplication Level Data

TCP/IPstack IP routing

TCP/IP

Network addressing, routing

6

Standards @ 2,4 GHzFrequecy Standard Radio Bit rate

Max/NetRange Encryption Status Note

2,4 GHz 802.11DS CSMA/CA,DSSS,PSK

2/1 Mbit/s 100 m @2Mbit/s

N/A Outdated Notavailableany more

2,4 GHz 802.11FH CSMA/CA,FHSS,PSK

2/1 Mbit/s 100 m @ 2Mbit/s

N/A Outdated Notavailableany more

2,4 GHz 802.11b CSMA/CA,DSSS,CKK

11/5 Mbit/s 60 m @ 11Mbit/s

WEP40 bit/128bit

Most used De Facto

2,4 GHz 802.11g CSMA/CA,OFDM taiDSSS

22/11 Mbit/s 60 m @ 11Mbit/s

WEP40 bit/128bit

Ready in2002?

Notavailable yet

2,4 GHz HomeRF TDMA/CSMA/CD,FHSS

1,6/0,5 Mbit/s 50 m @ 1,6Mbit/s

Blowfish Standardready

No productsavailable-residential

2,4 GHz HomeRF 2 WBFH 10 / 5 Mbit/s 50m @ 10Mbit/s

Open Open Open

Standard organisations IEEE (802.11 standards) and ETSI (HIPERLAN/2)

Standards around PHY and MAC-layer

WiFi –sertification very important for interoperability

CSMA/CA = Carrier Sense Multiple Access / Collision Avoidance, DSSS=Direct Sequence Spread Spectrum,PSK = Phase Shift Keying, FHSS = Frequency Hopping Spread Spectrum, CKK = Complementary Code Keying,WBFH = Wide Band Frequency Hopping, WEP = Wired Equivalent Privacy

7

Wireless Access: System Performance

Source: Nokia

BRAN

Hiperlan/2

802.11a

802.11b(11 Mbps)

802.11b (5.5 Mbps mode)

802.11

UMTS

HomeRF

10 m 30 m 60 m 100 m > 400 m200 m

500 kbps

1 Mbps

2 Mbps

54 Mbps

11 Mbps

Blue-tooth

5.5 Mbps

Personal AreaCoverage/ Serial

Cable Replacement

Wide AreaCoverage

Wireless LocalArea Coverage

Wireless LocalMultimedia

Grossbit rate

Indoors500 m 5 km Outdoors

8

InternetRoaming

Channel 1

Channel 1Channel 2

Channel 3 Channel 2

Network architecture

9

Why WLAN is not real “CDMA”

› In theory Direct Sequence Spread Spectrum (DSSS) canhandle several simultaneous connections on one frequency

› BUT› In order not to infere other transmissions on the same frequency,

the Chip-code used on the system should be at least15 bit = 2 simultaneous system

› In 802.11 WLAN there is only 11 bits (optimisation ofcomputational efficiency and costs)

=> Two systems on the same channel cause interference to eachother

=> User experiences this interference as bit rate reduction / smallercoverage

10

Channels and interference

1 2 3 84 6 75 9 10 11 12 13

2400 MHz 2483,5 MHz

Power EIRP100 mW = 20 dBm in Europe1000 mW = 30 dBm in USA

13 channels @2 Mbit/s bit rate3 channels @

11 Mbit/s bit rate

1 6 11

• 2,4 GHz is widely in use• (ISM band = Industrial, Scientific, Medical) open for all if power limit is not exceeded• No guarantees of channel availability• Microwaves operate the same band, but their interference is quite small in reality

• Most important sources of interference are other WLAN-networks, Bluetooth and WirelessVideo transmission systems

• Lack of channels is the most important problem=> Only one network in one premises

• There are different opinion on Bluetooth interference - but it still exisists

©Antti Siitonen, 2001

2 Mbit/s 90m radius

5.5 Mbit/s50m radius

11 Mbps30m radius

Access Point average indoor coverageIEEE 802.11b Standard DSSS

12

Outdoor Coverage

90 degreesChannel 1Max distance 1 km




25 degrees• 50 meters / 23 m• 200 meters / 93 m• 500 meters / 233 m

13

Link budgetDownlink Expected multpath fading 3 % 99,76 dBTXRF power 15 dBmPigtail -0,4 dB In meters 948,35 metersLMR400 22,5 m -5,3 dBLightning protecto -0,4 dB Frequency 2,45E+09Antenna 10 dBi Signal velocity 3E+08EIRP 18,9 dBm Wavelength 0,122449RXAntenna 2,45 dBi250 cm cable -0,5 dBSensitivity 82 dBmTreshold -84 dBm

More critical- Delay spread treshold

65 ns @ 11 Mbit/s500 ns @ 1 Mbit/s

14

Limitations

›Best effort resource management (CSMA/CA)› No QoS

› No guaranteed bit rates

› 11 Mbit/s system provides only 5,5 Mbit/s Layer 3 bit rateand is half duplex

› Channel limitation - only 3 orthogonal channels

› Several networks on the same spot cause interference

› Small power - short connections

› Practically Line of Sight

› Commercial equipment mainly for indoor use

15

Terminals› Laptop PCs

»PCMCIA-cards primary» IBM, HP, DELL and Toshiba offer also built in WLAN in

some laptop models» Trend: WLAN will be standard property of Laptop

› PDA:s» So far PCMCIA-cards + adapter» Examples: Compaq iPAQ ja HP Jornada» Trend: WLAN will integrate with PDA

» Challenges in battery life time

› Hybrids»WLAN+GPRS, WLAN+UMTS, WLAN+Bluetooth

16

Security: WLAN Physical Layer

›Licence free frequency band› Uncontrolled usage of frequency allows anyone to

use the spectrum

›› DENIAL OF SERVICE ATTACKSDENIAL OF SERVICE ATTACKS» Difficult (impossible) to prevent

›Spread Spectrum technology› Direct Sequence Spread Spectrum (most important)

› Frequency Hopping Spread Spectrum (less used)

› Basically complex methods, but

›› EAVESDROPPING IS POSSIBLEEAVESDROPPING IS POSSIBLE»» Buy a WLAN-card!Buy a WLAN-card!» Can be prevented on higher layers

17

WLAN DataLink Layer›Medium Access Control

› CSMA/CA

› RTS/CTS possible

›Security› IEEE 802.11 provides two security methods

» Authentication» Open System

» All stations may request authentication» Authentication can be granted to any request or only

those from defined stations» Shared Key

» Authentication only for those stations that possess asecret encryption key

» Encryption (optional) must be supported

» Encryption» Wired Equivalent Privacy (WEP) RC-4

18

WEP Authentication & Encryption› Based on RC4 PRNG algorithm from RSA Data Security Inc.

› Key length 40 - 128 bits

› Was originally selected to meet following criteria» reasonably strong ..but still easy and light to implement» self-synchronizing ..Packet loss, mobility» computationally efficent ..Price-performance» exportable ..NSA in USA

› Provides enough security to most purposes, BUTBUT› Encrypts only data (no headers)

› Has been proven to be weak [Walker, J. Unsafe at any key size; An analysis ofthe WEP encapsulation, IEEE 802.11-00/362, October 2000]

› Easy to insert extra packets in to the network

› Attacks may be done by passive eavesdropping - software available in Internet

› Manual key management» Difficult (Impossible) on public network

»» WEAK SECURITY - NONE AT PUBLIC NETWORKWEAK SECURITY - NONE AT PUBLIC NETWORK

19

WLAN Security in general› Standard security solution is weak andimplementation has disadvantages

› Must be taken into consideration when planning high securitysolutions

› Can not be used in public networks

› WEP encryption doesn’t solve higher layersecurity needs

› Authentication for users and terminals

› Session encryption, integrity and origin

› Ipsec and application layer solutions areIpsec and application layer solutions arerecommendedrecommended

20

Unlicenced spectrum standards

1998 2000 2001 2002 2003

Hiperlan 1

WLA

Ns

WPA

Ns

IEEE 802.11b

HomeRF

IRdA Bluetooth 1.1

HomeRFWideband

Bluetooth 2

IEEE 802.11a

802.11g,I,e

IEEE 802.11h

Harmonized5GHz

Infrared

128kbit/s-10 Mbit/s 700 kbit/s

2,4 GHzHigher bit ratesNew profilesNew radio

3-10 Mbit/s

1,6 Mbit/s 8 Mbit/s

No support

2,4 GHz

11 Mbit/s 5 GHz

5 GHz

23 Mbit/s

Hiperlan 2

54 Mbit/s

Higher bit rate, security,QoS

(Dynamic Frequency Selection,Transmit Power Control)

?

Most probableevolution

36 Mbit/s

Frozen

21

WLAN-standards

20 01 20 02 20 03 20 041Q 2Q 3Q 4Q 1Q 2Q 3Q 4Q 1Q 2Q 3Q 4Q 1Q 2Q

IEEE 802.11BIEEE 802.11GIEEE 802.11I,EHiperlan 2 Europe

USAIEEE 802.11A Europe

USAIntegrated WLAN/GPRS??Integrated WLAN/UMTS??

Commercial usePilot use <1%Evaluation Building

Tech

olog

y

22

802.11 vs. HiperLAN/2Property 802.11 802.11b 802.11a HiperLAN/2Frequency 2.4 GHz 2.4 GHz 5 GHz 5 GHz~Max Layer 1bit rate

2 Mbit/s 11 Mbit/s 54 Mbit/s 54 Mbit/s

~Max Layer 3bit rate

1.2 Mbit/s 5 Mbit/s 32 Mbit/s 32 Mbit/s

Resourcemanagement

Best effort–CSMA/CA

Best effort –CSMA/CA

Best effort –CSMA/CA

Centralizedmanagement /TDMA/TDD

Connection Connectionless Connectionless Connectionless ConnectionlessQoS Poor Poor Poor AdequateEncryption Poor RC4 Poor RC4 So far poor RC4 Good DES,

3DESRadio LinkQuality control

Poor Poor So far poor Good

Wiredconnection

Ethernet Ethernet Ethernet Ethernet, IP,ATM, UMTS,FireWire, PPP

23

WLAN & UMTS› For GSM/GPRS/ÙMTS-operator WLAN is an opportunity to offer localhigh bit rate wireless data connections as an extention to basic mobileservices

› Interesting issues are roaming between technologies, userauthentiaction and customer relationship management and billing

› If hybrid terminals enter the market this scenario seems even moreinteresting

› Mobile IP, IPsec and IPv6 seem to be very interesting solutions for thiskind of usage scenarios

24

Roaming - current situation› WLAN networks mainly corporate private networks

› No roaming agreements

› For security reasons corporates will not open their networks

› By itself WLAN offers only local mobility

› In public netoworks there is always the “network name” challenge

› Often there is also separate access control for billing purposes

› Technology interoperability has improven a lot

25

ISP roaming› There are some RADIUS-based roaming implementations fortraditional Dialup-ISP-operators

› Clearing-houses iPASS and GRIC-communications

› Value: Local access services

› Could be utilized also in WLAN-implementations

› Primary option for ISP

› Challenge: Popularity

› Only partial solution

26

GSM-based roaming› In GSM there are several roaming agreements made and thesystem has proved to be working

› Using GSM technology for authentication, roaming and billingdoes’t solve all challenges and actually introduces some new

› If GSM technology is in use there is a need for external gatewaysolution between WLAN and GSM

› Solutions are available on the market, but they still need someintegration work before commercial launches

27

MobileIP› Macro mobility

BTS

BTS

BTS

Mobile Node

Soft Hand-off

SD

Sun E N T E R P R I S E

Ω

Ω

Ω

4 0 0 0

SPA RCDRIVENUL TRA

BSCFA

BTS

BTS

BTS

SD


Ω

Ω

Ω

4 0 0 0

SPA RCDRIVENUL TRA

BSCFA

Hard Hand-off

Parent FA

SD


Ω

Ω

Ω

4 0 0 0

SPA RCDRIV ENUL TR A

28

WLAN Business Models

› Corporate Market

› Equipment and solutions sales

› Solution as service (Operations and maintenance)

› Operated access network for public use

› Flat rate

› Time based or volume based billing

› Prepaid - voucher type

› WLAN as home network extension

› WLAN access as mobile extension

29

OperaatorinIP runkoverkko

Internet

PSTNN*64 kbps

Operaattorin palvelut:Signalling gateway, HLR, CAMEL, Mobile IP Home Agent WAP, SIP Proxy, DNS, WWW, E-mail, etc..

GSM

Media Gateway

Future Network?

IPv6- Real time QoS

- Multicast- Accounting

- Security- Mobility

One Terminal - several interfaces

GPRS

UMTS

HIPERLAN/2

Localmobilitydomain

WLAN

Digital TV

30

UMTS

UMTS

WLAN UMTS

WLAN

WLAN

GSM/GPRSStart

Send a picturemessage

DownloadMP3 music

files

Place aphone call

Check anddownload

e-mailmessages

A Future Usage Scenario

31

Summary› For corporate use WLAN offers already high bit rate IPconnections with local mobility

› Security issues must be taken into consideration - IP-VPN isrecommended

› WLAN fits best in controlled environment

› Interference and capacity issues can be handled if the environmentis restricted

› For mobile operator WLAN could offer complementary service toexisisting mobile services if mobile WLAN terminals emerge

› Billing

› Authentication & Customer Relationship Management

› Roaming

Documents

©Antti Siitonen, 2001 · Security › IEEE 802.11 provides two security methods » Authentication » Open System » All stations may request authentication » Authentication can