29
Figure 12
Shared key authentication process
WLAN data security
Compared with wired networks, WLAN networks are more susceptible to attacks because all WLAN devices
share the same medium. Thus, every device can receive data from any other sending device. If no security
service is provided, plain-text data is transmitted over the WLAN.
To secure data transmission, 802.11 protocols provide some encryption methods to ensure that devices
without the right key cannot read encrypted data.
1.
Plain-text data
All data packets are not encrypted. It is in fact a WLAN service without any security protection.
2.
WEP encryption
WEP was developed to protect data exchanged among authorized users in a wireless LAN from casual
eavesdropping. WEP uses RC4 encryption (a stream encryption algorithm) for confidentiality. WEP adopts
the RC4 algorithm (a stream encryption algorithm), supporting WEP40, WEP104 and WEP128 keys.
3.
TKIP encryption
TKIP and WEP both use the RC4 algorithm, but TKIP has many advantages over WEP, and provides more
secure protection for WLAN as follows:
First, TKIP provides longer IVs to enhance encryption security. Compared with WEP encryption, TKIP
encryption uses 128–bit RC4 encryption algorithm, and increases the length of IVs from 24 bits to 48
bits.
Second, TKIP allows for dynamic key negotiation to avoid static key configuration. TKIP replaces a
single static key with a base key generated by an authentication server. TKIP dynamic keys cannot be
easily deciphered.
Third, TKIP offers MIC and countermeasures. If a packet fails the MIC, the data may be tampered, and
the system may be attacked. If two packets fail the MIC in a certain period, the AP automatically takes
countermeasures. It does not provide services in a certain period to prevent attacks.
4.
CCMP encryption
CCMP is based on the CCM of the AES encryption algorithm. CCM combines CTR for confidentiality and
CBC-MAC for authentication and integrity. CCM protects the integrity of both the MPDU Data field and
selected portions of the IEEE 802.11 MPDU header. The AES block algorithm in CCMP uses a 128-bit key and
a 128-bit block size. Similarly, CCMP contains a dynamic key negotiation and management method, so that
each wireless client can dynamically negotiate a key suite, which can be updated periodically to further
AP
Client
Authentication Request
Authentication Response
（
Challenge
）
Authentication
（
Encrypted Challenge
）
Authentication Response
（
Success
）
