Table of Contents
Advertisement
Voice over WLAN Mobile IP Touch Design Guide R2.0
2.3. Security
Security is always a sensitive topic to discuss, and opinions on how best to provide for it vary greatly
from one engineer to the next. With this in mind, Alcatel-Lucent is constantly developing the list of
security options available within the MIPT VoWLAN solution offer to satisfy as many different opinions as
possible.
For the R 2.0 solution offer, Alcatel-Lucent makes the following security recommendations:
2.3.1. SSID Broadcast
When designing and managing a Wireless LAN, engineers must make calculated compromises
between performance and ease of use. One such decision is that of whether or not to broadcast
the SSID (Service Set Identifier) of a wireless network. Broadcasting the SSID allows clients to
"scan" for available network and then attempt to join them. This eliminates the need for users
to explicitly know the name of the network that must be defined in their 802.11 client
configuration, since it can be learned from the over-the-air broadcasts (excluding MIPT terminals
that must be configured manually by design.) Obviously, not broadcasting the SSID provides the
opposite: users must know the SSID.
In the above mentioned way, it is commonly thought that we can offer a limited realm of security
simply by not broadcasting the SSID of the Wi-Fi environment dedicated to VoWLAN activity. In
truth, this practice is often far more troublesome to network administrators than it is to network
attackers. The advantages of SSID broadcast usually far exceed the threat of visibility it offers.
Since all MIPT terminals must be manually configured with an SSID, the decision to enable or
disable SSID broadcast is of little consequence to Alcatel-Lucent MIPT terminals. There is no
impact to ease of use or functionality presented by the state of SSID broadcast. Alcatel-Lucent
recommends that customers maintain their current or desired security policies governing this
topic.
2.3.2. Authentication & Encryption
At present, for the MIPT R 2.0 offer, Alcatel-Lucent provides authentication and encryption
options based on WEP (Static Key),WPA-PSK and WPA2-PSK (802.11i / AES encryption). This
means that, if selected, wireless traffic for VoWLAN can be encrypted based either on RC4
ciphering techniques (with or without TKIP) or on AES (WPA2), and "Shared Key" authentication
mechanisms. Pre Shared Keys must be manually entered in each MIPT terminal at installation. In
the case of WPA/WPA2-PSK implementation, the Pre Shared Key is used for initial authentication
and as the seed for Temporal Key Integrity Protocol key rotations. No other authentication
and/or encryption options are presently available (i.e. 802.1x authentication.)
WEP is recognized as being a weak security option due to the static nature of the encryption key.
Derivation of the key is possible through simple passive scanning techniques and data analysis.
To counter this problem, the Wi-Fi Alliance has defined a standard known as WPA. WPA, in
reality, is WEP enhanced with TKIP key rotation. This prevents key derivation through passive
scanning and brute force attacks. WPA-PSK can be implemented in most infrastructure
environments through simple software upgrades, making it a universally available, simple and
effective scheme for content protection.
Alcatel-Lucent strongly recommends the use of WPA2 (or at least WPA) in order to provide the
highest levels of confidentiality and network security. The password length must be greater than
twenty characters in order to avoid the brute force attacks.
ESD/ Central Pre Sales / DF/ PH
20/45
January 2007 – Ed 01
Hide quick links:
Advertisement
Table of Contents
