October 30, 2003
(Computerworld)
The recent proliferation of high-speed wireless portable devices has resulted in a significant demand for wireless LAN. While WLANs offer tremendous flexibility to the mobile user, compared with their wire-line equivalents, WLANs are more susceptible to security threats because data is transmitted through the air.
While encryption technology provides protection against most security threats, intruder-generated security threats are still possible. Two types of intrusion threats that are easy to launch are traffic monitoring and passive eavesdropping.
Traffic monitoring is typically performed by an intruder that is outside the perimeter of the enterprise, whereby he observes the traffic flow, and makes assessments about the 1) nature of traffic, 2) amount of traffic and 3) load on the network.
Passive eavesdropping on the other hand, generally occurs from within the perimeter. The intruder could use the information gathered by way of traffic monitoring combined with passive eavesdropping to attack users as well as the network. Early detection of such intrusions could help service providers proactively address the impending attacks.
This article explores the ways and means for containing these two threats with the use of smart antenna systems and describes a layered security architecture that addresses the general security threats.
Smart antennas for WLANs
The most basic form of an antenna is the omni-directional antenna element, which has a spherical region of coverage in an ideal outdoor usage scenario. However, when indoors, radio propagation leads to interferences due to phenomena such as multipath effects.
A directional antenna element, on the other hand, has a preferred transmission and reception direction that reduces interferences due to multipath effects. A number of directional antennas can be used to increase the range of transmission so as to establish point-to-point connectivity. When more complex patterns consisting of angular sectors of coverage are required, a sectorized antenna that uses several directional antennas is used.
A more advanced solution is a smart antenna system that combines multiple antenna elements with intelligent signal processing. When used within an 802.11 access point (AP), it provides the following benefits: interference reduction, multipath reduction, increased network capacity and efficient utilization of battery power. These benefits are due to its ability to automatically change the direction of transmission and reception patterns in adaptive response to changes in the environment.
Smart antenna systems may be broadly categorized into two types: switched beam antenna and adaptive array. The switched beam antenna system uses multiple fixed beams with each beam having a different sensitivity, thereby resulting in system sensitivity that varies with direction, with the result that the system can switch reception direction as a mobile communicating client changes its location. The adaptive antenna array system uses advanced signal processing to effectively locate and track various types of signals, which dynamically minimizes interference and maximizes signal reception.
Smart antennas for security
An important benefit of smart antenna systems is their ability to provide point-to-point connectivity.
This combined with an intelligent receiving antenna on the user's mobile client can enhance the security of communication by 1) reducing signal leakage outside the enterprise perimeter via controlled transmission and reception of radio signals and 2) reducing the threat of passive eavesdropping by constantly monitoring and performing statistical analysis on the signal environment to detect anomaly in signal patterns.
Further advances in antenna technology would help reduce the complexity of signal anomaly detection.
Perimeter security
An important concern in enterprise WLAN usage is that of securing the perimeter. The range of transmission in an omni-directional antenna may be constrained by controlling power, yet the antenna would still transmit some amounts of signal beyond the perimeter of the enterprise into unrestricted spaces such as parking lots.
Such leakage may be reduced or even contained by placing multiple sensors to monitor signal strengths at various points within the WLAN space and networking these sensor nodes. That would form a monitoring system that feeds into a control system that regulates transmitter power for reducing Wi-Fi signal leaks outside the perimeter.
Also, these sensor nodes can be embedded with a jamming technology with the purpose of nullifying the signals in locations outside the enterprise perimeter. The challenge of such a solution is to not block the genuine enterprise users.
Figure 1
The use of smart antennas permits a design as shown in Figure 1 above that, with well-engineered placement and tuning of APs, could potentially transform the WLAN perimeter to lie within the physical perimeter of the enterprise.
User-directed transmission could be further focused by accurate control of range and direction of transmission. The user's client and AP negotiates the minimal signal strength (via power control) to use for communication at the beginning of a session, taking into account cable losses, power loss during signal propagation and losses due to propagation phenomena such as reflection, diffraction and scattering.
Passive intruder detection through power control
Figure 2
Effective power control helps in passive intruder detection by constantly monitoring any possible drop in signal strength, and if an intruder is suspected, the antenna used to communicate with the user may be switched (see Figure 2 above). It is possible that the drop in signal strength could be due to changes in the environment or intrusion. In either case, antenna switching is a safe option.
Further, when there are multiple antennas within the range of a user's client, passive intrusion can be proactively avoided by the use of antenna switching sequence.
 |   Rajit Gadh  V. Sridhar  K. Kalyana Rao |
Layered security architecture
We propose an overlay of a four-layered security architecture that sits upon the smart antenna infrastructure with the objective of resolving problems such as threats related to traffic monitoring and passive eavesdropping.
In addition, active eavesdropping, unauthorized access, man-in-the-middle attack and session hijacking are additional security threats the layered approach would have the potential to address.
References
1. Donald Welch and Scott Lathrop, "A Survey of 802.11a Wireless Security Threats and Security Mechanisms," Technical Report ITOC-TR-2003-101, Information Technology and Operations Center, Dept. EE & CS, U.S. Military Academy, N.Y., 2003.
2. Martin Cooper, "Antennas get smart," Scientific American, July 2003, pp 41-47.
3. John Regnier, "Benefits of Smart Antennas in 802.11 Networks," Presented to IEEE 802.11 Wireless Next Generation Standing Committee, January 2003.
About the authors
Rajit Gadh is a professor at the Henry Samueli School of Engineering and Applied Science at the University of California, Los Angeles, where he heads the Wireless Internet for Mobile Enterprise Consortium (WINMEC).
Kalyan Rao is president of the Technology Solutions Group and Telecommunications, Infrastructure, Media, Entertainment and Semiconductor (TIMES) group at Satyam Computer Services Ltd., a consulting and IT services company in India. He has B.E. and master's degrees in electrical communication engineering from the Indian Institute of Science in Bangalore, India.
V. Sridhar is the head of Applied Research Group, TIMES business unit at Satyam. He has a Ph.D. in computer science from Indian Institute of Science, Bangalore, and has over 15 years of industry experience.