Bedienungsanleitung Compaq Ipaq 3630 wireless security (Seite 23 von 30) (Englisch)

35484

Zoom out

Zoom in

Vorherige Seite

1/30

Nächste Seite

Wireless Security White Paper 23

Authentication

Infowave uses NTLM challenge/response authentication. Infowave sends no user information

over the link other than the encrypted NTLM token.

Authorization

Once it has authenticated the user, the Infowave server determines what resources the user is

authorized and licensed to access. The Infowave server grants or denies access to the Exchange

mailbox, for example. It also sends an authentication request back to the Infowave client

software. The authentication request is processed using the NTLM credentials cached on the

client device.

Encryption

For asymmetric encryption, Infowave uses the Elliptic Curve Cryptography (ECC) encryption

algorithm from the Certicom Security Builder toolkit. The Infowave server maintains a private

and public key pair that is generated on installation. Infowave clients know the server’s public key

and use it to perform the symmetric key exchange for all data transfers. ECC is significantly

faster than the standard RSA encryption algorithms, and is well suited to mobile devices. The

Wireless Business Engine is designed to support a number of different encryption algorithm

combinations. The Certicom ECC/DESX combination is the currently implemented algorithm

pair, but an arbitrary number of algorithms can be supported.

For symmetric encryption, Infowave uses DESX, a strengthened variant of the Data Encryption

Standard (DES) method of encryption that originated at IBM in 1977. Infowave randomly

generates a DESX symmetric key pair on each client every time the client logs on. This key pair

is used to encrypt session traffic.

Data Integrity

Infowave compresses, encrypts, and delivers data using its wireless protocol. The Infowave

server analyzes the data to determine the best compression algorithm. The combination of

encryption and compression ensures that data cannot be altered during transmission. If data shows

signs of having been altered, the receiving side of the exchange does not accept it.

Non-repudiation

If the Infowave client software falls into unfriendly hands, the attacker can gain knowledge only

of the Infowave server public key and the number of the access port. The breach of this

information is not critical. Without knowing the user’s Windows NT domain name, user ID, and

password, the attacker can get no further than the Infowave server. The Windows NT domain

name is combined with other information and encrypted with the server’s public key, which keeps

an attacker from impersonating a valid user.

Possible Security Problem

There may be a significant problem with Infowave security in that the client is not able to validate

the public key of the Infowave server (WBE). This implies vulnerability to a "man-in-the-middle"

attack where a client request is intercepted and then relayed to the server. The man in the middle

can then eavesdrop on the entire transmission.

According to Infowave, this design decision was made to support server public key download at

the cost of the potential security hole mentioned above. At the time the design was implemented,

the client-side libraries did not support signing of the server public key. This will be changed in

future versions.

Missbrauch melden von Frage und/oder Antwort

Libble nimmt den Missbrauch seiner Dienste sehr ernst. Wir setzen uns dafür ein, derartige Missbrauchsfälle gemäß den Gesetzen Ihres Heimatlandes zu behandeln. Wenn Sie eine Meldung übermitteln, überprüfen wir Ihre Informationen und ergreifen entsprechende Maßnahmen. Wir melden uns nur dann wieder bei Ihnen, wenn wir weitere Einzelheiten wissen müssen oder weitere Informationen für Sie haben.

Compaq Ipaq 3630 wireless security Seite 23

Brauchen Sie Hilfe? Stellen Sie Ihre Frage.

Missbrauch melden von Frage und/oder Antwort

Art des Missbrauchs:

Forenregeln

Neu registrieren

Das Handbuch wird per E-Mail gesendet. Überprüfen Sie ihre E-Mail.

Ihre Frage wurde zu diesem Forum hinzugefügt

Info