Build secure Wi-Fi coverage via cooperation federation
•
0 gostou•636 visualizações
This document discusses building cooperative Wi-Fi networks through federated authentication. It outlines two options: an "easy" option of using a common network name without encryption or authentication, and a "proper" option of using WPA2 Enterprise encryption and authentication across networks. The "proper" option has been successfully implemented in networks like eduroam and roam.fi and provides benefits like secure roaming access and network control while protecting user privacy. Technical details of federated RADIUS authentication are also covered.
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (17)
Semelhante a Build secure Wi-Fi coverage via cooperation federation
Semelhante a Build secure Wi-Fi coverage via cooperation federation (20)
Mais de Karri Huhtanen
Mais de Karri Huhtanen (20)
Último
Último (20)
Build secure Wi-Fi coverage via cooperation federation
- 1. Building secure, privacy aware, quality Wi-Fi coverage via cooperation Karri Huhtanen Arch Red Oy & Open System Consultants Pty Ltd 22.9.2015
- 2. quality and the traditional way of building coverage Photo by Karl-Ludwig G. Poggemann
- 3. In the beginning... already a lot of separate, overlapping Wi-Fi networks interfering with each other Map by OpenStreetMap
- 4. already a lot of separate, overlapping Wi-Fi networks interfering with each other + one more, the new common Wi-Fi network Then... Map by OpenStreetMap
- 5. So this is bad, because... • more overlapping Wi-Fi networks => more radio interference => all Wi-Fi network users suffer • providing additional coverage, capacity and bandwidth always generates costs to someone • maintaining, upgrading and repairing additional network always generates costs to someone • often the additional coverage is also provided outdoors and from outside => which means excellent Wi-Fi coverage for magpies during Finnish winters Photo by Andrew King
- 6. What to do? Photo by Sean Hobson
- 7. Try cooperation... Photo by Sean Hobson
- 8. Instead of this... Map by OpenStreetMap
- 9. Let’s try this... Map by OpenStreetMap unification via cooperation
- 10. We must be realistic... • Somebody has to cover the costs of providing coverage, capacity, bandwidth and maintaining, upgrading and repairing network => Dividing work and costs makes sense => Let everyone handle and control their part of the network • We need unified policies for network configuration, authentication, access filtering, IP addressing etc. => Let’s just choose open standard interfaces and policies, no specific vendors or service providers • There will still be overlapping private networks, home networks etc. => interference cannot be removed but it can be reduced • Coverage is not really needed everywhere, it is needed where the existing networks already are => with unified network settings around it is easier to access Internet in various places
- 11. So how can this be done? Photo by Sean Hobson
- 12. two options “Easy” “Proper” Scale by winnifredxoxo
- 13. “Easy” • use common but original Wi-Fi network name for all cooperating networks, make the name neutral so that it is easier to adopt • leave Wi-Fi network without authentication or encryption or specify common WPA2 pre-shared secret, share this secret to everyone • have and enforce a common policy for Internet filtering and IP addressing everywhere • wish for the best and believe in the goodness of the people • that’s it: everyone controls and is responsible of their own part of network and partially what happens through it Photo by RobbyVan Moor
- 14. For few reasons “easy” option has not catched on • People want to have unauthenticated, unencrypted and unfiltered networks to use, but very few want to provide such ones themselves. • People still want to have curtains for privacy, doors for access control, pin codes for credit cards and mobile phones. • People responsible of what happens in or through their networks are even more careful. • “easy” networks are often filtered so heavily that instead of ‘open’ they often should be called ‘broken’. • Access and capacity control, monitoring and network management are still needed, even in so called ‘open’ networks.
- 15. Photo by Thomas Guine Photo by RobbyVan Moor “Proper” • use common but original Wi-Fi network name for all cooperating networks, make the name neutral so that it is easier to adopt • use WPA2 Enterprise encryption and authentication for everyone and every network, connect networks into coverage area by authentication federation • have and enforce a common policy for Internet filtering, IP addressing and network configuration everywhere • that’s it: everyone controls and is responsible of their own part of network and partially what happens through it, visitors leave trails that can be followed, device and visitor access can be controlled
- 16. But has this then catched on? • Short answer: Yes. • eduroam(tm) (www.eduroam.org), the global authentication federation for universities and research organisations is the world’s 3rd most advertised Wi-Fi network and the roaming standard of academic world • eduroam(tm) technologies and architecture have been applied in Wireless Tampere community network and its successor roam.fi, which is used already in Tampere and neighboring cities • Belnet has started a pilot in Belgium about government roaming called govroam(tm) (www.govroam.be) • The architecture is compatible with operator roaming and technologies such as SIM card or certificate authentication, elliptic curves etc. in addition to traditional username and password
- 17. What are the additional benefits? • A common Wi-Fi network with same network configuration accessible everywhere securely with home organisation credentials but at the same time protecting the user privacy. • Access to the network, used capacity and traffic can be controlled and prioritized. Trail of accountability exists. • The core infrastructure and architecture is field tested, it has already been used and developed for over 10 years by operators, by eduroam etc. • The core infrastructure can be extended and evolved as authentication and network technologies develop, in most times even without changes to the core. • All technologies and interfaces used are open standards, defined mostly in IETF. There exists both open source and commercial options for components and services from several suppliers.
- 18. What now and in the future? • All the components for building this kind of cooperative Wi-Fi authentication federation exists. • Together with Centre of Open Systems and Solutions (COSS ry), already 2 operators and several cities and organisations, Wireless Tampere model is migrated and rebranded to roam.fi concept. • roam.fi aims to be eduroam for any organisation, city, company or operator, not just academic organisations • If interested, come and discuss with me or COSS about details.
- 19. Thank you. Questions? Karri Huhtanen https://www.twitter.com/khuhtanen https://plus.google.com/+KarriHuhtanen/ these and more slides: http://www.slideshare.net/khuhtanen/
- 20. Additional Slides for technical and non-technical questions
- 21. Federated RADIUS Roaming Federation Top-Level roam.fi RADIUS (proxy) Home Organisation homeorg.fi RADIUS Visited Organisation visitedorg.fi RADIUS home organisation roam.fi Wi-Fi network visited organisation roam.fi Wi-Fi network RADIUS connections
- 22. Authentication in Home Network Federation Top-Level roam.fi RADIUS (proxy) Home Organisation homeorg.fi RADIUS Visited Organisation visitedorg.fi RADIUS home organisation roam.fi Wi-Fi network visited organisation roam.fi Wi-Fi network secure authentication directly to home RADIUS username@homeorg.fi + password
- 23. Authentication in Visited Network Federation Top-Level roam.fi RADIUS (proxy) Home Organisation homeorg.fi RADIUS Visited Organisation visitedorg.fi RADIUS home organisation roam.fi Wi-Fi network visited organisation roam.fi Wi-Fi network Authentication is tunnelled with TLS directly to home RADIUS. Even Visited Organisation cannot see the actual credentials. same username@homeorg.fi + password, no change to network settings
- 24. WPA2 Enterprise Authentication real identity+credentials can always be secure inside TLS tunnel Access Controller e.g. Wi-Fi controller or access point RADIUS authentication service RADIUS protocol + TLS tunnel WPA2 Enterprise Authentication outer identity needs only identify home organisation, otherwise anonymous identity allowed Inside EAP message multiple methods of authentication and credentials can be used in parallel in same federated Wi-Fi networks. Home organisation capabilities are the only limiting factor.
- 25. What about electromagnetic radiation, Wi-Fi and children? • There is no scientific evidence or research results, which would prove that Wi-Fi is in anyway harmful. • If additional discussion is needed, author strongly recommends discussion with for example Vesa Linja-aho, Lilja Tamminen, or scientists with actual degrees from relevant fields (physics, medicine, etc.)