Ask the Expert
Questions from our readers...

Client vs. Backhaul Security

Wireless networks can be divided into two categories: client and backhaul. This month, we’ll discuss how the difference between these networks affects the ways in which they are secured. A security solution that is right for one may not be ideal for the other.

Defining Client vs. Backhaul Networks

Client networks provide network access to wireless clients, such as laptops, VoIP phones, and handheld devices. Backhaul networks wirelessly connect the APs that provide the client access. For example, a metro Wi-Fi installation might consist of 802.11 APs mounted on utility poles with wireless mesh routers connecting the APs back to a building with a wired Internet connection. In that architecture, the APs are part of a client network, while the mesh routers are part of a backhaul network. In another example, wireless bridges might be used to create a point-to-point link between the wired network in two buildings. In this case, the wireless network has no client access at all, and is exclusively a backhaul network. This would also be the case if the wired networks of several buildings were connected in a mesh or point-to-multipoint configuration. Finally, in the case where an AP is directly connected to a wired network, the network has no wireless backhaul component, and consists exclusively of a client component.

Security Considerations

Ease of use and ease of management are primary considerations in a client network. Clients must be able to quickly and simply associate to the network. Any unnecessary hassle on the client’s part gives the user an incentive to compromise the security of the system—e.g. by writing his or her password down on a sticky-note, or something like that. Client network security must be easily and centrally managed. There are likely to be a large number of clients using the network, and manual or distributed management will probably be impractical. Finally, client network security must be standardized, as there are likely to be a wide variety of client devices using the network. Non-standard solutions will prohibit certain clients from using the network, which is probably not desirable.

The primary difference between a backhaul network and a client network is that a backhaul network usually consists of a smaller number of static nodes. This means that a more manual type of configuration may be practical, since there are fewer nodes to configure, and once the nodes are configured, they usually don’t need to be revisited very often. In addition, the nodes in a backhaul network are typically completely controlled by the administrator of the network, which means that proprietary security mechanisms may be appropriate. For example, since all of one’s mesh routers are typically bought from the same company, it doesn’t matter if they use some proprietary form of encryption, since they are all guaranteed to support it.

Best Security Choices

For client-mode access, the clear choice for wireless authentication and encryption is WPA or WPA2. These two security standards provide an excellent balance of strong encryption and easy configuration. WPA2 is somewhat stronger than WPA, since WPA2 can use the more robust AES encryption, but not all devices have the hardware, firmware, and drivers necessary to support WPA2. Most APs are capable of operating in a mode that supports both WPA and WPA2 clients. In this mode, clients that are capable of WPA2 can opt to use it, but clients that cannot use WPA2 can still connect using WPA. Even though WPA is somewhat less secure than WPA2, it is still more than adequate for all but the most sensitive applications.

WPA and WPA2 each come in two flavors: personal and enterprise. The personal flavor authenticates users with a pass phrase, which is manually entered into the APs and the client machines. Of course, this method does not scale well to large networks, and is only appropriate for smaller networks, where the number of clients and APs permits manual configuration. The enterprise flavor authenticates users with a central authentication server. This allows for both stronger authentication methods and for centralized management, and is the most appropriate method for large networks. If weak pass phrases, such as short words and words that are found in the dictionary, are used, then WPA-personal and WPA2-personal are subject to certain attacks, but with strong pass phrases, they are essentially as secure as the enterprise flavor.

WPA and WPA2 are sometimes used for backhaul security. In this case, it is more common to see the personal flavor being used, as it is desirable to have the backhaul be mostly self-contained. If enterprise mode were used, the backhaul nodes (mesh routers or wireless bridges, usually) would have to contact an authentication server before they could join the network. This creates somewhat of a chicken-and-the-egg situation in which the node cannot join the network until it contacts an authentication server, but the authentication server might not be accessible until the node joins the network. The primary advantage of enterprise mode WPA is that it facilitates a large and dynamic user pool. This advantage is not necessary in backhaul networks.

It is also often the case that manufacturers of backhaul networks eschew WPA entirely and instead use some proprietary form of encryption. Because all of the 802.11-related backhaul technologies are proprietary in nature, standardization and interoperability are not major factors. Manufacturers correctly expect that a customer will buy his or her entire backhaul architecture from the same manufacturer. Therefore, the manufacturer can include proprietary technology without worrying that it will compromise the ability of the customer to build the network. Including proprietary encryption mechanisms has two potential advantages. First, the manufacturer might choose to use a more secure form of encryption than even WPA2. This might require the inclusion of dedicated encryption co-processors in the wireless devices, but since the manufacturer is building all of the equipment, this is an acceptable choice. Second, because of its non-standard nature, a proprietary (and therefore secret) form of encryption may be more resistant to attack than a standardized form, whose details are publicly available. Because a proprietary form of encryption is less common, there may also be less incentive to develop exploits for it. Therefore, while proprietary forms of encryption should probably be avoided in client access networks, they are acceptable or even preferred in backhaul networks.

Edge-Core Skype Wi-Fi Phone

Every month, we see announcements of new Wi-Fi phones. They fall into two main categories: those designed to work with standard SIP protocols and those designed to work with the proprietary Skype protocols. A few phones can actually do both. This phone falls into the latter category. It allows the user to make and receive Skype calls via a Wi-Fi network.

One of the issues that has been pointed out with regard to VoIP Wi-Fi handsets is that their lack of robust authentication methods makes them less than desirable. This handset supports both WPA-PSK and WPA2-PSK, so hopefully this is a sign of a trend towards including stronger authentication in VoIP Wi-Fi handsets.

Product Page

Press Release

Dell Adds Pre-Standard 802.11n To Laptops

Dell announced this month that it would include pre-standard 802.11n in its XPS laptops and a few of its Inspiron systems. The cards are based on Broadcom’s Intensi-Fi chipset, which is also used in the NetGear RangeMax Next product line. This decision underscores the pressure that is on the industry to provide consumers with the latest and greatest technology, but it doesn’t change Connect802’s stance on 802.11n. 802.11g and 802.11a are capable of meeting wireless networking needs today, and more importantly, pre-standard technologies are too risky for enterprise network administrators to rely on. It’s one thing if a home user has to replace the wireless card in his or her laptop, but it’s a whole other thing if an enterprise network administrator has to replace hundreds or thousands of APs and clients. Fortunately, the wireless cards that are included with the Dell laptops are replaceable add-on cards and are not embedded into the laptop itself.

That being said, customers don’t need to avoid laptops with integrated pre-802.11n. Even pre-standard 802.11n chipsets are backwards compatible with 802.11b, 802.11g, and 802.11a (if the chipset supports 5 GHz). When making a purchasing decision, the informed consumer should simply pretend that these laptops include integrated 802.11a/b/g and ignore the pre-standard 802.11n component. If, after purchase, the 802.11n component works well, then so much the better, and if it gets broken by the standards ratification process, then nothing has been lost.

Skype handset by Edge-Core