Extensible Authentication Protocol

Extensible Authentication Protocol (EAP) is an authentication framework included in Windows Client and Windows Server operating systems. EAP in Windows includes many authentication protocols for network access authentication when you deploy dial-up, virtual private network (VPN), 802.1X wireless, and 802.1X wired technologies using Network Policy Server (NPS), Routing and Remote Access Service (RRAS), or both.

EAP includes password-based authentication methods and more secure certificate-based authentication methods that you can use if you deploy a public key infrastructure with Active Directory Certificate Services or other public or private certification authorities.

EAP includes Protected EAP (PEAP) and is extensible because it allows developers to create new authentication types that you can plug in to your existing EAP deployment.

Note: In Windows Server 2003, Network Policy Server was named Internet Authentication Service.

Different wireless technologies that WLANs use

Laser/Infrared

    Both laser and infrared transmission fall under that same category in that the method of transmission and  reception are similar.  Networks are created when optical transmitter and receiver are in the line-of-sight and are able to make the hand shake. In much the same way that your CD player reads the 1's and 0's on the disk data is sent and received by way of packets (packs) of 1's and 0's.  Below is a diagram that will explain how information is exchanged between local networks.

                                                Optical Management Interface (OMI)
                                                            Figure 1. Optical Management Interface (OMI)
                                                                        Ref:  http://www.eagleopt.com/omi.htm
 
        Implementation of such a system can be very cheap or very costly.  Just transceivers themselves can range from thousands of dollars for infrared systems to much higher for laser.  Of course price is strongly dependent on the utility requirements.  Therefore it's crucial for management to weigh the many different factors:
        Pros:

• Very high data transfer rate, up to Gbps for laser and 155Mbps for infrared(1.25 miles)
• Long range in data transfer:  hundreds of miles for laser and upto 2.5 miles for infrared (10Mbps)
• Multiple channel access
• Digital transmission
• Low cost device (cheap IR-LEDs)

        Cons:

• Data transfer rate is inversly proportional to distance
• Large and bulky units prevents mobile networking
• Must have direct-line-of-sight
• Greatly affected by the change in the transmitting medium (air, stray sunlight, clouds)
 Article links: Laser/infrared networking Research and Technology,  FAQs

Micro-Wave (mW)

    Microwave radios have traditionally had a perception of being reliable and fast, but also complicated to install and maintain. Some of today's newer microwave systems have made significant improvements. They are light weight, compact and easy to install and maintain. In fact, the some of the smaller microwave systems require only a 2.5 inch post mounted on the roof or inside an office window to operate effectively. These factors reduce the time it takes to install as well as the related cost. In most cases, all that is required to physically install a microwave system are details such as placement of the antennas, type of mount to be used, and placement of the cable runs from the outdoor radio unit to the indoor data interface unit.    Microwave systems require a clear line-of-site between the two locations. This implies that there can be no obstacles or obstructions in the path of the microwave signal. In order to accomplish this,
microwave antennas are located as high as possible. Generally, microwave antennas are mounted on roofs of buildings, radio towers, or other tall structures. In the event that a clear line-of-site cannot be established, systems are sometimes repeated over objects (i.e., other buildings) or reflected around an object using specific microwave passive repeaters. In many cases it is necessary to perform a site survey in order to assure a clear line-of-site.
    Microwave system performance can be affected by environmental and atmospheric factors. The most irevalent factor that affects microwave signals is rain, especially in the higher frequency bands (above 18 GHz). Rain has the adverse property of absorbing microwave energy and attenuating the signal path. Other factors such as snow, fog, smog, temperature inversions, etc., have minimal effects on microwave performance.
    Even with these environmental factors, microwave communications can offer greater than 99.995 %availability. In order to assure reliable communications, microwave systems are designed to
accommodate the rain factor in several ways. First, the worst case rain rate is identified for a specific region. Most often, microwave path designers plan for rainfalls that exceed the 0.01 % rain rate. This amount can range anywhere from one inch per hour in Arizona to four inches per hour in Florida. Second, the maximum path distance is calculated with the worst case rainfall. This means that systems that can operate up to three miles in Arizona may only be able to operate up to one mile in Florida. Third, antenna size is determined to achieve the desired reliability factor. The larger the antenna size, the higher the focusing factor, or gain. A 99.995 % availability translates into about 26 total minutes of statistical outage in one year.
    Most microwave LAN systems operate in the 23 GHz band and require licensing by the Federal
Communications Commission (FCC). This licensing procedure is a simple process and assures the
user of interference free operation. The licensing process consists of two steps: First, a frequency
coordination is performed to determine an available frequency. Many search firms are available in the U.S. that can perform this task. They basically have access to a regularly updated database that
identifies other existing microwave users in various geographic areas. The geographic coordinates of
your intended site is submitted to one of these search firms to allow them to accurately recommend a unique frequency that has minimal interference potential. Site coordinates are generally obtained from a site survey. Second, a License Request form 402 is filed with the FCC along with the frequency coordination report. After reviewing your submittal, the FCC grants your station the license to operate that specific microwave system at that specific site using the requested frequencies. The process takes about two weeks for frequency coordination and 60 days for the FCC license approval. This entire process can be handled by most search firms.

        Below is a summary of  the pros and cons for microwave LAN units:
                Pros:

• Operating at 24GHz frequency domain, not FCC regulated.
• Can relocate system without relicencing through FCC
• Moderate data transfer rate of up to 20Mbps
• Up to 10 miles transmission range with 2feet high antennae
     Cons:

•  Microwaves are like sound waves which can have interference problem under
•  high traffic condition.
•  Large antennae prevents hand held mobile units
•  Must operate within same room, cannot penetrate walls
 Microwave Networking,
Wireless Networking over Microwave,
10 Questions on Microwave Networking

Radio Frequency (RF)

 Narrowband Technology    A narrowband radio system transmits and receives user information on a specific radio frequency. Narrowband radio keeps the radio signal frequency as narrow as possible just to pass the information.Undesirable crosstalk between communications channels is avoided by carefully coordinating different users on different channel
frequencies.
Spread Spectrum
    Most wireless LAN systems use spread-spectrum technology, a wideband radio frequency technique developed by the military for use in reliable, secure, mission-critical communications systems. Spread-spectrum is designed to trade off bandwidth efficiency for reliability, integrity, and security. In other words, more bandwidth is consumed than in the case of narrowband transmission, but the tradeoff produces a signal that is, in effect, louder and thus easier to detect, provided that the receiver knows the parameters of the spread-spectrum signal being broadcast. If a receiver is not tuned to the right frequency, a spread-spectrum signal looks like background noise. There are two types of spread spectrum radio: frequency hopping and direct sequence.
    A private telephone line is much like a radio frequency. When each home in a neighborhood has its own private telephone line, people in one home cannot listen to calls made to other homes. In a radio system, privacy and noninterference are accomplished by the use of separate radio frequencies. The radio receiver filters out all radio
signals except the ones on its designated frequency.
    An interesting note to the development history of Spread Spectrum is that the idea of didn't really come from the think tank of the armed forces or its affiliates.  Instead, the idea of spreading the signal into this wideband to guide
long range missiles without being intercepted by enemies came as a result of a dinner discussion between an actress and a composer.  Check this story out at the Secret Communications System link.

back to main menu

Frequency Hopping

Frequency-Hopping Spread Spectrum TechnologyFrequency-hopping spread-spectrum (FHSS) uses a narrowband carrier that changes frequency in a pattern known to both transmitter and receiver. Properly synchronized, the net effect is to maintain a single logical channel. To an unintended receiver, FHSS appears to be short-duration impulse noise.
 


 
 Figure 2a. Frequency Hopping Spread Spectrum(Ref:  http://www.wlana.com/intro/introduction/wirels.html)

Direct Sequencing

Direct-Sequence Spread Spectrum TechnologyDirect-sequence spread-spectrum (DSSS) generates a redundant bit pattern for each bit to be transmitted. This bit pattern is called a chip (or chipping code). The longer the chip, the greater the probability that the original data can be recovered (and, of course, the more bandwidth required). Even if one or more bits in the chip are damaged during transmission, statistical techniques embedded in the radio can recover the original data without the need for retransmission. To an unintended receiver, DSSS appears as low-power wideband noise and is rejected (ignored) by most narrowband receivers.


 

                                                Fig. 2b.  Direct Sequencing Spread Spectrum.

                                     (Ref:   http://www.wlana.com/intro/introduction/wirels.html)

WLAN Authentication and Encryption Methods

When deploying a wireless LAN, it is very important to deploy secure methods for authentication and encryption so that the network can only be used by those individuals and devices that are authorized. This article takes a look at the commonly used methods of wireless LAN authentication as well as the available encryption methods.

WLAN Authentication Methods

It is important to understand that there is a distinction between being authenticated onto a wireless network and then having the traffic passed be encrypted. It is possible to be authenticated onto a network and pass open unencrypted traffic; this section looks at the commonly used methods of authentication.

There are three main methods of authentication that are used on today’s wireless LANs:

• open authentication
• shared authentication
• EAP (Extensible Authentication Protocol) authentication

The open authentication method is the simplest of the methods used and only requires that the end device be aware of the Service-Set Identifier (SSID) used on the network, as long as the SSID is known then the device will be allowed onto the network. The problem with this method is that the SSID is typically broadcast and if it is not, it can be easy to figure out with passive capturing techniques.

The shared authentication method is commonly used on individual and small business wireless LAN implementations; this method uses a shared key (Pre-Shared Key – PSK) that is given to both sides of the connection; if they match then the device is allowed onto the network.

The third method uses the Extensible Authentication Protocol (EAP) and is the most common method used by enterprises. The EAP method utilizes an authentication server that is queried for authentication using a variety of credential options.

WLAN Encryption Methods

Along with the method used for authentication, the choice of encryption method is a very important part of deploying a wireless LAN. Many of the encryption methods that were implemented in earlier wireless LAN standards have been proven insecure and have been depreciated by more modern methods. As time goes on, this is sure to happen with all encryption techniques as they are used more commonly (thus becoming a target for exploitation) and as processing power continues to increase.

Here are the WLAN encryption methods we’ll review today:

• Wired Equivalent Privacy (WEP)
• Wi-Fi Protected Access (WPA)
• Wi-Fi Protected Access 2 (WPA2)

The first widely used standard for wireless LANs was 802.11 (prime); this included the Wired Equivalent Privacy (WEP) algorithm which was used for security. WEP utilizes RC4 for encryption and has been depreciated because of vulnerabilities that can be used to find the security keys.

In response to the vulnerabilities found in WEP, Wi-Fi Protected Access (WPA)was defined. WPA utilizes the Temporal Key Integrity Protocol (TKIP) which utilizes dynamic keys that were not supported with WEP and RC4 for encryption. The TKIP method used with WPA was utilized until vulnerabilities were found in TKIP. These vulnerabilities center on the fact that TKIP uses some of the same mechanisms that WEP does which allow similar attacks.

In response to the vulnerabilities in WPA/TKIP, the IEEE 802.11i standard was defined and implemented; the IEEE 802.11i standard is also referred to as WPA2.WPA2 replaced TKIP with Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP) which is based on Advanced Encryption Standard (AES); it is common for the WPA2 encryption method to be referred to as AES. As of this writing, there are no easy methods that have been found to break AES.

Summary

How secure a wireless LAN is, greatly depends on a number of different configuration parameters that must be entered correctly. The problem with many existing wireless LANs is that the people that are implementing them simply do not have the security knowledge required to maintain a secure wireless network.

All existing and future wireless LAN implementers should make the effort to learn about the most secure methods provided by the chosen equipment (and quite possibly be part of the equipment selection process). The advantage that most modern equipment has is that the WPA2 standard is supported and not that hard to implement.

Hopefully this article can act as a primer to this education and will provide current and future WLAN administrators some information they need to secure their networks.

Wireless local area networks (WLANs)

Wireless local area networks (WLANs) are the same as the traditional LAN but they have a wireless interface. With the introduction of small portable devices such as PDAs (personal digital assistants), the WLAN technology is becoming very popular. WLANs provide high speed data communication in small areas such as a building or an office. It allows users to move around in a confined area while they are still connected to the network. Examples of wireless LAN that are available today are NCR's waveLAN and Motorola's ALTAIR.
In this article, the transmission technology used in WLANs is considered. We will also discuss some of the technical standards for WLANs developed by the IEEE Project 802.11.


Figure 1 : The Motorola Envoy (PDA) [2]

---

Transmission Technology

There are three main ways by which WLANs transmit information : microwave, spread spectrum and infrared.

Microwave Transmission

Motorola's WLAN product (ALTAIR) transmits data by using low powered microwave radio signals. It operates at the 18GHz frequency band.

Spread Spectrum Transmission

With this transmission technology, there are two methods used by wireless LAN products : frequency hopping and direct sequence modulation.

• Frequency Hopping 
  The signal jumps from one frequency to another within a given frequency range. The transmitter device "listens" to a channel, if it detects an idle time (i.e. no signal is transmitted), it transmits the data using the full channel bandwidth. If the channel is full, it "hops" to another channel and repeats the process. The transmitter and the receiver "jump" in the same manner.
• Direct Sequence Modulation 
  This method uses a wide frequency band together with Code Division Multiple Access (CDMA). Signals from different units are transmitted at a given frequency range. The power levels of these signals are very low (just above background noise). A code is transmitted with each signal so that the receiver can identify the appropriate signal transmitted by the sender unit.
  The frequency at which such signals are transmitted is called the ISM (industrial, scientific and medical) band. This frequency band is reserved for ISM devices. The ISM band has three frequency ranges : 902-928, 2400-2483.5 and 5725-5850 MHz. An exception to this is Motorola's ALTAIR which operates at 18GHz.
  Spread spectrum transmission technology is used by many wireless LAN manufacturers such as NCR for waveLAN product and SpectraLink for the 2000 PCS.

Infrared Transmission

This method uses infrared light to carry information. There are three types of infrared transmission : diffused, directed and directed point-to-point.

• Diffused 
  The infrared light transmitted by the sender unit fills the area (e.g. office). Therefore the receiver unit located anywhere in that area can receive the signal.
• Directed 
  The infrared light is focused before transmitting the signal. This method increases the transmission speed.
• Directed point-to-point 
  Directed point-to-point infrared transmission provides the highest transmission speed. Here the receiver is aligned with the sender unit. The infrared light is then transmitted directly to the receiver.

The light source used in infrared transmission depends on the environmemt. Light emitting diode (LED) is used in indoor areas, while lasers are used in outdoor areas.
Infrared radiation (IR) has major biological effects. It greatly affects the eyes and skin. Microwave signals are also dangerous to health. But with proper design of systems, these effects are reduced considerably.

---

Technical Standards

Technical standards are one of the main concerns of users of wireless LAN products. Users would like to be able to buy wireless products from different manufacturers and be able to use them on one network. The IEEE Project 802.11 has set up universal standards for wireless LAN. In this section we will consider some of these standards.

Requirements

In March 1992 the IEEE Project 802.11 established a set of requirements for wireless LAN. The minimum bandwidth needed for operations such as file transfer and program loading is 1Mbps. Operations which need real-time data transmission such as digital voice and process control, need support from time bounded services.

Types of Wireless LAN

The Project 802.11 committee distinguished between two types of wireless LAN : "ad-hoc" and "infrastructred" networks.


Figure 2 : (a) Infrastructred Wireless LAN; (b) Ad-hoc Wireless LAN. [3] 

Ad-hoc Networks

Figure 2b shows an ad-hoc network. This network can be set up by a number mobile users meeting in a small room. It does not need any support from a wired/wireless backbone. There are two ways to implement this network.

• Broadcasting/Flooding 
  Suppose that a mobile user A wants to send data to another user B in the same area. When the packets containing the data are ready, user A broadcasts the packets. On receiving the packets, the receiver checks the identification on the packet. If that receiver was not the correct destination, then it rebroadcasts the packets. This process is repeated until user B gets the data.
• Temporary Infrastructure 
  In this method, the mobile users set up a temporary infrastructure. But this method is complicated and it introduces overheads. It is useful only when there is a small number of mobile users.

Infrastructure Networks

Figure 2a shows an infrastructure-based network. This type of network allows users to move in a building while they are connected to computer resources.
The IEEE Project 802.11 specified the components in a wireless LAN architecture. In an infrastructure network, a cell is also known as a Basic Service Area (BSA). It contains a number of wireless stations. The size of a BSA depends on the power of the transmitter and receiver units, it also depends on the environment. A number of BSAs are connected to each other and to a distribution system by Access Points (APs). A group of stations belonging to an AP is called a Basic Service Set (BSS). Figure 3 shows the basic architecture for wireless LANs.


Figure 3 : Architecture for Wireless LANs [2] 

---

Conclusion

Wireless LAN provide high speed data communication. The minimum data rate specified by the IEEE Project 802.11 is 1Mbps. NCR's waveLAN operates at 2Mbps, while Motorola's ALTAIR operates at 15Mbps.
Because of their limited mobility and short transmission range, wireless LANs can be used in confined areas such as a conference room. In the U.S, almost all WLANs products use spread spectrum transmission. Therefore they transmit information on the ISM band. But with this frequency band, users can experience interference from other sources using this band. 

Wireless Technology

Wireless is a term used to describe telecommunications in which electromagnetic waves (rather than some form of wire) carry the signal over part or all of the communication path. Some monitoring devices, such as intrusion alarms, employ acoustic waves at frequencies above the range of human hearing; these are also sometimes classified as wireless.

The first wireless transmitters went on the air in the early 20th century using radiotelegraphy (Morse code). Later, as modulation made it possible to transmit voices and music via wireless, the medium came to be called "radio." With the advent of television, fax, data communication, and the effective use of a larger portion of the spectrum, the term "wireless" has been resurrected.

Common examples of wireless equipment in use today include:

• Cellular phones and pagers -- provide connectivity for portable and mobile applications, both personal and business
• Global Positioning System (GPS) -- allows drivers of cars and trucks, captains of boats and ships, and pilots of aircraft to ascertain their location anywhere on earth
• Cordless computer peripherals -- the cordless mouse is a common example; keyboards and printers can also be linked to a computer via wireless
• Cordless telephone sets -- these are limited-range devices, not to be confused with cell phones
• Home-entertainment-system control boxes -- the VCR control and the TV channel control are the most common examples; some hi-fi sound systems and FM broadcast receivers also use this technology
• Remote garage-door openers -- one of the oldest wireless devices in common use by consumers; usually operates at radio frequencies
• Two-way radios -- this includes Amateur and Citizens Radio Service, as well as business, marine, and military communications
• Baby monitors -- these devices are simplified radio transmitter/receiver units with limited range
• Satellite television -- allows viewers in almost any location to select from hundreds of channels
• Wireless LANs or local area networks -- provide flexibility and reliability for business computer users

Wireless technology is rapidly evolving, and is playing an increasing role in the lives of people throughout the world. In addition, ever-larger numbers of people are relying on the technology directly or indirectly. (It has been suggested that wireless is overused in some situations, creating a social nuisance.) More specialized and exotic examples of wireless communications and control include:

• Global System for Mobile Communication (GSM) -- a digital mobile telephone system used in Europe and other parts of the world; the de facto wireless telephone standard in Europe
• General Packet Radio Service (GPRS) -- a packet-based wireless communication service that provides continuous connection to the Internet for mobile phone and computer users
• Enhanced Data GSM Environment (EDGE) -- a faster version of the Global System for Mobile (GSM) wireless service
• Universal Mobile Telecommunications System (UMTS) -- a broadband, packet-based system offering a consistent set of services to mobile computer and phone users no matter where they are located in the world
• Wireless Application Protocol (WAP) -- a set of communication protocols to standardize the way that wireless devices, such as cellular telephones and radio transceivers, can be used for Internet access
• i-Mode -- the world's first "smart phone" for Web browsing, first introduced in Japan; provides color and video over telephone sets

Wireless can be divided into:

• Fixed wireless -- the operation of wireless devices or systems in homes and offices, and in particular, equipment connected to the Internet via specialized modems
• Mobile wireless -- the use of wireless devices or systems aboard motorized, moving vehicles; examples include the automotive cell phone and PCS (personal communications services)
• Portable wireless -- the operation of autonomous, battery-powered wireless devices or systems outside the office, home, or vehicle; examples include handheld cell phones and PCS units
• IR wireless -- the use of devices that convey data via IR (infrared) radiation; employed in certain limited-range communications and control systems

Wireless networking

 Is used to meet many needs. Perhaps the most common use is to connect laptop users who travel from location to location. Another common use is for mobile networks that connect via satellite. A wireless transmission method is a logical choice to network a LAN segment that must frequently change locations. The following situations justify the use of wireless technology:

• To span a distance beyond the capabilities of typical cabling,
• To provide a backup communications link in case of normal network failure,
• To link portable or temporary workstations,
• To overcome situations where normal cabling is difficult or financially impractical, or
• To remotely connect mobile users or networks.

Developers need to consider some parameters involving Wireless RF technology for better developing wireless networks:

• Sub-GHz versus 2.4 GHz frequency trends
• Operating range and battery life
• Sensitivity and data rate
• Network topology and node intelligence

The 802.1X Standard

IEEE 802.1X is an IEEE Standard for Port-based Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN.

IEEE 802.1X defines the encapsulation of the Extensible Authentication Protocol (EAP) over IEEE 802, which is known as "EAP over LAN" or EAPOL. EAPOL was originally designed for IEEE 802.3 Ethernet in 802.1X-2001, but was clarified to suit other IEEE 802 LAN technologies such as IEEE 802.11 wireless and Fiber Distributed Data Interface (ISO 9314-2) in 802.1X-2004. The EAPOL protocol was also modified for use with IEEE 802.1AE (“MACsec”) and IEEE 802.1AR (Secure Device Identity, DevID) in 802.1X-2010 to support service identification and optional point to point encryption over the local LAN segment.

802.1X authentication helps mitigate many of the risks involved in using WEP. For example, one of the biggest problems with WEP is the long life of keys and the fact that they are shared among many users and are well known. With 802.1X, each station could have a unique WEP key for every session. The Authenticator (Wireless Access Point) could also choose to change the WEP key very frequently, such as once every 10 minutes or every 1000 frames. 802.1X does not guarantee improved security. For example, an authenticator might never change the key it hands out to each supplicant. Or, the network manager might select an authentication method that does not allow for distribution of WEP keys. 802.1X does, however, give the informed network manager the potential to design and implement a more secure WLAN.