IEEE 802.11i

Counter-Mode /CBC-MAC Protocol (CCMP)

It is a data-confidentiality protocol that handles packet authentication as well as encryption. CCMP uses a 128-bit key in IEEE 802.11i. It can prevent some problems that are not encrypted. Moreover, IEEE 802.11i uses additional authentication data (AAD) frame to protect. AAD includes the packets source and destination and protects against attackers replaying packets to different destinations.

IEEE 802.11r

The 802.11r standard applies to a 3-tier mention architecture that divides the access network into mobility zones. A mobility zone is defined as the collection of lightweight access points connected to a central management unit, here after referred to as controller. Generally, neighbouring access points covering a certain geographic zone are grouped into a single mobility zone.

When a 802.11r compliant station enters a mobility zone, it first performs authentication using EAP. The resulting MSK is used by the station and the controller to derive a key called PMK-R0. PMK-R0 is then used to derive per-access-point PMKs. The name for such keys is PMK-R1. The controller finally sends the PMK-R1 keys to their corresponding access points. The mobility zone controller that holds the PMK-R0 key is called R0 Key Holder (R0KH), while the access points to which PMK-R1 keys are delivered are R1 Key Holder(R1KH).

IEEE 802.11k

IEEE 802.11k provides Radio Resource Management. That can enable STAs to understand the radio environment in which they exist. The Radio Resource Management service includes measurements that extends the capability, reliability, and the maintainability of WLANs by providing standard measurement s across vendors, and provides the resulting measurement data to upper layers in the communications stack.

IEEE 802.11w.

The IEEE 802.11w wireless encryption standard builds on the 802.11i framework to protect against subtle attacks on wireless LAN (WLAN) management frames .IEEE 802.11w defines enhancements such as data integrity, data origin authenticity, replay protection, and data confidentiality.

Microsoft’s Active Directory Security Feature

Microsoft’s Active Directory

An active directory is a directory structure used on Microsoft Windows computers and servers to store information about networks and domains. It is primarily used for online information and was originally created in 1996. It was first used with Windows 2000.

An active directory (sometimes referred to as an AD) has many functions. It provides information on objects, organizes these objects for easy retrieval and access, allows users and administrators to access it, and allows the administrator to set security up for the directory.

Microsoft’s Active Directory Security Feature

Query-Based Distribution Groups – it is a new additional type of distribution group in exchange 2003. This new type of distribution group provides the same functionality as a standard distribution group, but it is allows us to use an LDAP query to dynamically build membership in the distribution group.

WMI filtering of GPOs – WMI filters are a way to fine tune the application of GPOs. It’s evaluated at the time of a group policy refresh at the client. WMI filters are best used as an exception mechanism where a GPO is to be applied for a well-defined period of time.

Cross-Forest trust – it is a features of Microsoft’s Windows Server that enables trust to be automatically managed between multiple Active Directory forests. It is used especially helpful for consolidation operations due to mergers and acquisitions.

LDAP Security Feature

LDAP

LDAP, Lightweight Directory Access Protocol, is an internet protocol that email and other programs use to look up information from a server. LDAP is based on the standards contained within the X.500 standard, but is simpler. Moreover, it is not like X.500. LDPA can support TCP/IP, which is necessary for any type of internet access. LDAP is an open protocol, so applications need not worry about the type of server hosting directory. 

LDPA features

Client-Server Communication – When a client transmits a protocol request for operation to be performed to the server, the server performs the some operations in its directory and after that the server returns a response containing results or errors to the client.

TCP (as the transporting protocol) ­– The server implements a mapping of LDAP over TCP in which LDAP message PDUs are mapped directly onto the TCP byte stream, and provides a protocol listener for the mode of operation on IP port 389.

SSL over TCP (as the transporting protocol) ­– The server implements a mapping of LDAP over SSL over TCP in which the LDAP Message PDUs are mapped directly onto the SSL byte stream, and provide a protocol listener for the mode of operation on IP port 636.

Transport Security (startTLS) – The server allows a client to perform a Start TLS operation, and negotiates Transport Layer Security (TLS) as a result.

X.500 Security Feature

X.500

X.500 is the directory access protocol (DAP) by ITU-T (X.500) and ISO (ISO/IEC 9594), and it is a standard way to develop an electronic directory for people so it can be one of the part of a worldwide directory available to everyone who can access the internet.

X.500 protocols

There are four protocols in the X.500. They are Directory Access Protocol (DAP), Directory System Protocol (DSP), Directory Information Shadowing Protocol (DISP) and Directory Operational Bindings Protocol (DOP).

• Directory Access protocol (DAP) is the client queries and receives responses from one or more servers which is in the server directory service with DAP managing the communication of the client to the server and vice-versa.  
• Directory System Protocol (DSP) is to controls the communication of two or more directory system agents, and also a directory user agent and a directory system agent.
• Directory Information Shadowing Protocol (DISP) can used to manage the information of the directory system agent.
• Directory Operational Bindings Protocol (DOP) is used to communicate between two directory system agents.

X.500 key features

·       

• Decentralized maintenance which can update its local part of the directory and also maintenance. 
• Powerful Searching Capabilities which can provide the powerful searching facilities. 
• Single Global Namespace which is like DNS, it can provide a single homogeneous namespace to users. 
• Structured Information Framework which allowing local extensions to get the information framework of the directory. 
• Standard-Based Directory Services which is used to build a standard-based directory that requires for directory information.

GPRS Security Feature, Threats and Solution

The General Packet Radio Service (GPRS) is a new non-voice value added service that allows information to be sent and received across a mobile telephone network. It supplements today’s Circuit Switched Data and Short Message Service. GPRS is NOT related to GPS (the Global Positioning System), a similar acronym that is often used in mobile contexts.

Feature: The technical security offered by GPRS is very similar to that offered by GSM. GPRS has several unique features which can be summarized as:

Immediacy: GPRS facilitates instant connections whereby information can be sent or received immediately as the need arises. No dial-up modem connection is necessary. This is why GPRS users are sometimes referred to be as being "always connected". Immediacy is one of the advantages of GPRS (and SMS) when compared to Circuit Switched Data. High immediacy is a very important feature for time critical applications such as remote credit card authorization where it would be unacceptable to keep the customer waiting for even thirty extra seconds.

Speed: Theoretical maximum speeds of up to 171.2 kilobits per second (kbps) are achievable with GPRS using all eight timeslots at the same time. This is about three times as fast as the data transmission speeds possible over today’s fixed telecommunications networks and ten times as fast as current Circuit Switched Data services on GSM networks.

Threats:

Availability: The most common type of attack on availability is a denial of service (DOS) attack. There are several types of denial of service attacks that are possible on the GPRS.

Border Gateway bandwidth saturation: a malicious operator that is also connected to the same GPX may have the ability to generate a sufficient amount of network traffic directed at your Border Gateway.

Solution:

1.      Ingress and egress packet filtering

2.      GTP Traffic Shaping

3.      Implement IPSec tunnels with roaming partners