Bedienungsanleitung Compaq Ipaq 3630 wireless security (Seite 26 von 30) (Englisch)

35484

Zoom out

Zoom in

Vorherige Seite

1/30

Nächste Seite

Wireless Security White Paper 26

• For security reasons, the authentication information must be cryptologically secure. This

implies that the Authenticator cannot decrypt the credentials.

• The model must be extensible to new authentication mechanisms as they are invented and

implemented.

In order to ensure that the Authenticator can always identify and interpret new authentication

mechanisms, any authentication types must be encapsulated using the Extensible Authentication

Protocol (EAP) as specified in RFC 2284. EAP already supports multiple authentication schemes

including smart cards, Kerberos, Public Key Encryptions, and One Time Passwords. Many others

can be added.

The biggest security consideration of 802.1x is that its sole purpose is authentication. It does not

provide integrity, encryption, replay protection or non-repudiation. These would need to be

implemented with complementary schemes such as IPSec.

There are also other points of vulnerability that must be addressed in any implementation of

802.1x:

• Piggybacking on an authenticated port – Multiple end stations on a port must be detected and

disconnected

• Interception of credentials – Passwords must always be encrypted

• Subversion of authentication negotiation – It should not be possible to provoke a lesser form

of authentication by interfering with the authentication process

802.11b WLANs are ideal candidates for 802.1x authentication since they represent a completely

uncontrolled periphery. While it is possible to restrict physical access to wired LANs, this is not

feasible in a wireless environment. It is much more difficult to monitor and enforce the air space

around office buildings than the ports and wiring within them.

This vulnerability is currently addressed using Wired Equivalent Privacy (WEP), which is

available on 802.11b Access Points. If WEP is in use, then all stations must configure a

symmetric passphrase in order to connect. All transmission is then encrypted with 40-128 bit

encryption.

Recently, there have been alleged cryptological weaknesses with the WEP algorithms that have

cast a shadow on its use. Beyond these there is a fundamental problem with key distribution and

update. Since WEP keys are typically symmetrical (the same on the Access Point and all

connecting stations) they must be changed in unison. Clearly this is difficult to orchestrate when

large user populations are involved.

There have been solutions, including automating regular key changes, for example, using logon

scripts; however, they are non-standard and require additional work. There are also problems

ensuring that employees who leave the company no longer have access to the network, since they

could “remember” their WEP key.

Another aspect of the problem arises when users connect to multiple different wireless LANs

(e.g. in public areas or at customer sites). Current WEP implementations require that the user

manually change the WEP key each time a new network is selected, which is tedious and

interferes with any automated key changes.

802.1x solves all of these problems. It is not necessary to distribute any keys. The user can

authenticate to a central Authentication server, which stores per-user credentials that can be

disabled or modified as needed.

Missbrauch melden von Frage und/oder Antwort

Libble nimmt den Missbrauch seiner Dienste sehr ernst. Wir setzen uns dafür ein, derartige Missbrauchsfälle gemäß den Gesetzen Ihres Heimatlandes zu behandeln. Wenn Sie eine Meldung übermitteln, überprüfen wir Ihre Informationen und ergreifen entsprechende Maßnahmen. Wir melden uns nur dann wieder bei Ihnen, wenn wir weitere Einzelheiten wissen müssen oder weitere Informationen für Sie haben.

Compaq Ipaq 3630 wireless security Seite 26

Brauchen Sie Hilfe? Stellen Sie Ihre Frage.

Missbrauch melden von Frage und/oder Antwort

Art des Missbrauchs:

Forenregeln

Neu registrieren

Das Handbuch wird per E-Mail gesendet. Überprüfen Sie ihre E-Mail.

Ihre Frage wurde zu diesem Forum hinzugefügt

Info