November 2004

Sidebar: VoIP Over WLAN: Security Issues In Wireless Versus Wired Networks

BY Debasish “Ron” Nag & Ravi Kodavarti

As VoIP and WLAN technologies penetrate residential and enterprise markets, we are witnessing a great deal of advancement in performance, cost reduction, and feature development. We are also witnessing the tight coupling of these core technologies to provide an end-to-end mobile Voice over WLAN (VoWLAN) system. Security will clearly be a critical requirement for combined VoIP and WLAN data and voice systems. The security dynamics of wired VoIP environments are compounded further when calls can be sniffed over the air in wireless deployments. Therefore, both the voice packet and its associated wireless transmission channel have to be secured.

The goals of security in any voice network are two-fold:

• Privacy — ensuring that voice privacy is maintained during conversations, and records of conversations and calls are protected.
• Infrastructure Protection — ensuring that the network is secure against rogue mobile terminals and that “reproduction” of network elements is not possible; correct billing systems are maintained; Denial of Service (DoS) attacks are minimized; and authentication between a mobile terminal and mobile network can be accomplished.

There are four areas in VoIP applications that need different security mechanisms: configuration, signals, voice, and data. While each area of security can be established independent of the other, it is preferred that the authentication key for signals be obtained and that the media key be passed down to the signaling security application.

The transmission of voice communications thus far has taken place over traditional POTS networks or, more recently, wired data networks. Even with the security issues, wired data networks still provide one significant level of security — Ethernet jacks are usually well protected and inside a firewall. A hacker needs to get access to the building in order to get into the firewall. Wireless networks do not provide this element of security. WLANs are, by definition, accessible over the medium and hence susceptible to “parking lot” attacks. A hacker on the street can break into a protected firewall, and is not just trying to get into the corporate firewall via the Internet. Additionally, as the network is wireless, a fake network can be created just as easily to gather user information. The security provided by an Ethernet jack is lost on wireless networks. Therefore, authentication in wireless networks must run two ways — the network must authenticate the user, and the user must authenticate the network.

Current generations of WLAN products use WEP as the security mechanism for the network to authenticate the user, and encryption of the data between an Access Point and a Client Station. The authentication that is provided by WEP does not allow for two way authentication, i.e., the user does not authenticate the network. Additionally, reuse of keys in WEP allows for a hacker to break the key fairly easily, and WEP does not allow for any automated key exchange mechanism. Hence, in most cases WEP is not implemented.

802.11i addresses the security deficiencies of WEP in two phases — by providing a mechanism for current generation products to be software upgradeable, and by creating a new Robust Security Network that may need hardware changes. The first phase was adopted by the WiFi Alliance as WPA (Wireless Protected Access), and the ratified 802.11i specification is adopted as WPA2. WPA essentially puts a wrapper around the RC4 encryption scheme that is used in WEP to provide mutual authentication of the user and the network, automated and secure key exchange, and replay protection of voice (and data) packets. WPA2 enhances WPA by using AES (Advanced Encryption Standard) instead of RC4 as the encryption engine. However, WPA2 protects the infrastructure investments of WPA by using a similar mechanism of automated key exchange.

A true differentiator of wireless networks over wired networks is that it provides the user the ability to roam between Access Points and maintain a voice connection during the process. However, the challenge is to roam securely and maintain QoS during the process. The work being started in 802.11r addresses the issues related to fast secure roaming. At present, Cisco Compatible Extensions (CCX), as well as potentially other proprietary implementations, provide mechanisms to roam between Stations and Access Points in a secure way.

VoIP that is transported via a wireless network requires three levels of security: for the voice transmission; its associated control signaling and configuration; and for the WLAN channel by which voice traffic is transported. The combination of VoIP and WLAN will offer the market many new applications. In order to secure these applications, packet and wireless issues must be dealt with in concert. IT

Debasish “Ron” Nag and Ravi Kodavarti are with Texas Instruments’ VoIP Group. For more information, please visit the company online at www.ti.com.

If you are interested in purchasing reprints of this article (in either print or HTML format), please visit Reprint Management Services online at www.reprintbuyer.com or contact a representative via e-mail at [email protected] or by phone at 800-290-5460.

[ Return To The November 2004 Of Contents ]