Download Wireless Security Concerns

Wireless Security Concerns(WTLS and the WAP GAP)
By
Deepthi Kovvuri
Why is wireless security important?


By 2004 there will be more than 40% wireless internet users in United states
By 2004 50% of internet hits will originate from wireless devices.
 More and more security critical applications will run on wireless devices for
example banking, e-Wallets, mobile payment systems etc.
What are the challenges in wireless security?
Small footprint devices- These are devices with low processing power and small
memory.
Network- Less bandwidth, more latency, less connection stability and less predictable
availability.
Introduction to Wireless Application Protocol (WAP)
In 1997 the term WAP hit all the headlines all over the world and everyone started
looking at it as the new money making machine in the telecommunications area.WAP –
The Wireless Application protocol is a communications protocol and application
environment for the deployment of information resources, advanced telephony services,
and internet access from mobile devices. WAP is basically a set of protocols that
optimizes standard TCP/IP/HTTP/HTML protocols, for use under the low bandwidth,
high latency conditions often found in wireless security.A study compared the number of
packets needed to process a stock quote query from a desktop browser using HTTP 1.0
with the same query from a WAP browser. The WAP protocol was found to use less than
half the number of packets that the standard HTTP/TCP/IP stack uses to deliver the same
content. This improvement is essential to best utilize the limited wireless bandwidth
available.
WAP System architecture
WAP Gateway(Refer to the figure below)
When a WAP session is started on a mobile phone a connection is created using WSP
between the mobile device and the WAP gateway. WSP is a protocol responsible for
starting and ending connections from the mobile devices to WAP gateway. The gateway
translates the WSP request into a HTTP request and sends it to the appropriate server.
The origin server then sends the response via HTTP to the Gateway. The gateway
translates and compresses the information and sends it back to the mobile device.
Summary of the functionality provided by the gateway
1. Translates between HTTP and WSP
2. The CODER/DECODER functionality in the gateway is used to convert the
WML and WML script going to and coming from the client into a form that is
optimized for low bandwidth networks.
3. A HTML to WML translator (optional).
4. Charging/billing functionality
5. Also implements an interface for each of the bearers present in the wireless
network of the operator.
WAP 1.0 Software Architecture
The WAP protocol stack as shown below consists of 5 layers. The figure on the left
shows the corresponding internet protocol stack.
Application Layer (WAE)
HTML, JavaScript etc…
Session Layer(WSP)
HTTP
Transaction Layer(WTP)
Security Layer(WTLS)
SSL
Transport Layer(WDP)
TCP,UDP
Bearers (SMS, CSD,USSD,
CDMA, CDPD…)
IP, DataLink Layer,
Physical Layer
TLS: TLS uses public key cryptography, bulk encryption algorithms and shared secret
key exchange techniques to provide privacy over the internet. Public key cryptography is
used to exchange a shared secret key for bulk encryption at the beginning of a secure
internet connection.
WTLS (Wireless Transport Layer Security):WTLS is an optional layer and is based
on TLS (Transport Layer security) which is in turn based on SSL(Secure Sockets
Layer).WTLS operates over transport layer WDP.WTLS attempts to lighten the
overheads associated establishing a secure connection between two applications. WTLS
generally uses RSA based cryptography. However, the protocol can also use elliptic
curve cryptography(ECC) which provides a high level of security while demanding fewer
computing and memory resources than other encryption approaches. This is an important
consideration for the small footprint hand-held devices.WTLS processes security
algorithms faster by minimizing the protocol overhead and enables more data
compression than traditional TLS solutions. The translation between TLS and WTLS
takes milliseconds and occurs in the memory of a WAP gateway. The content of the
volatile memory is erased as quickly as possible. In WTLS , a client and a gateway share
on secret key and a gateway and server share another secret key during a secure session.
WTLS Vs TLSWTLS
Datagram Support
Expanded set of alerts
Optimized handshake
New certificate format
Addition cipher suites
Client identities
Key refresh option
Separate Read and Write channels
The difference is that WTLS added
some additional features which are
oriented towards the challenges of
transporting data over a wireless network.
The table below shows the features added
onto the WTLS which are not included in
TLS.
WAP GAP The main criticism with WAP has not been the WTLS protocol but the
role of the WAP gateway server as a point of transition between the wired and the
wireless networks.Tokenization- WML content coming from the internet or another
provider is encoded into a compact binary form at the WAP gateway before being sent to
the wireless device. During this process the WAP gateway can also check that the WML
has no errors and is well formed.Translation of the data takes place in the memory of the
gateway. No encrypted data is ever stored on the secondary storage of the gateway.
However this causes a big security risk as it assumes a shift of trust from the application
provider to the network provider. The two security implications of the WAP architecture
are
1. The WTLS session is between the phone and the WAP gateway, not the vendors
server. This means that data is only encrypted between the phone and the
gateway, at which point it is decrypted by the gateway before being re-encrypted
and sent on to the vendor’s server over a TLS connection.
2. The WAP gateway gets to see all of the data in clear text
Solutions
Network Operator hosted WAP Gateway:This is the classic configuration with the
WAP Gateway located at the operator’s site.
Several security problems with this solution:There is no way for the web server to require
that the phone use the security protocol WTLS since WTLS is optional. Actually there is
no way for the WEB server to know whether WTLS is being used between the WAP
phone and gateway.All data is decrypted at the gateway to listen to traffic .There is no
way for the WEB server to detect eavesdropping or tampering.There is no way for the
WEB server to know the identity of the WAP user and it is not possible for the WAP user
to know that it is indeed speaking to the correct WEB server. This allows for man-in-themiddle attacks.
Corporate Operated WAP Gateway To host the gateway at the corporate premises is
the natural next step to increase security. The WAP gateway is moved inside a corporate
firewall and placed in the same physical location as the WEB server. This solution takes
care of some of the problems of the first solution but most of them are just moved inside
the corporate firewall.
Advantages:
 By placing the WAP gateway inside the corporate premises it is harder for
someone to listen or modify traffic between the WAP phone and WEB server.
 It is possible to configure the WAP gateway in such as manner that it requires
the phone to use WTLS and enforce sufficiently strong encryption.
Disadvantages:
 There is still no way for the web server to know the identity of the WAP user in
a secure way. This solution makes it considerably easier for corporate
employees, who may have physical access to gateway to monitor or modify
traffic.
 Additional problem that the gateway might be used by a hacker to modify or
break into other applications that may reside behind the same firewall.
 A separate gateway computer must be purchased that requires configuration and
support.
 If WTLS is enforced, all WAP phones that do not support WTLS may be
disabled.
WAP Gateway and WEB server on the same computerIn this scenario the WAP
gateway and the WEB server are located on the same physical computer inside the
firewall.
Advantages:This removes the requirement for the separate gateway computer and it is
harder for someone with physical access to the gateway to listen or to modify the traffic.
Disadvantages:The security concerns caused by this solution will be the same as the
previous solution.
Solutions with a WAP gateway on the same machine as the web server are
sometimes marketed as end-to-end secure solutions. However this is not a correct
description. WAP gateways will never perform encryption, cryptographic key exchanges
or authentication end-to-end. A WAP gateway will always require that the web server
keep a port open for HTTP communication.
Proprietary WAP Server A WAP server is similar to a WEB server, except that it uses
WAP protocols instead of HTTP protocol that WEB server’s use. This allows WAP
server to communicate directly with the WAP phone without a gateway. Hence a WAP
server may be used to achieve end-to-end security.
Disadvantage: There is no large base of existing applications available for these servers.
Hence these proprietary servers are used as gateways to connect to a real web server.
Used this way they are as insecure as any other gateway solution.
WAP server based on existing web server. In this scenario the WAP stack is built into
or integrated with an existing web server (eg. Apache).This solution combines the best of
both the worlds.
Advantages: The ease of use, available support and a large application base of an
industrial-strength WEB server and the end-to-end security of a WAP server.
End to End Security Model-Integrated Transport layer security (ITLS):The goal of
ITLS is to integrate transparently wireless internet security with TLS as follows-The
WAP gateway must not have the plain text even though the time is very short and
suppliers of WAP gateway must belong to service providers or network providers.In this
architecture the there are three secret keys, one between client and server, one between
client & gateway and one between server and gateway.
Encryption and decryption performed twice on the client side:
Disadvantages:The first concern in ITLS is that mobile devices will have more load
because of encrypting and decrypting twice. Secondly ,even though the message is sent
by a server that has errors in it a gateway cannot recognize it as it does not decrypt the
message.
Advantage: Achieves end-to end security
Future of WAP Security
The figure below shows the WAP 2.0 protocol stack.
XML
HTTP
TLS
W-TCP
IP
Network Bearer
The move to TLS in WAP 2.0 is being pushed by the much
publicized “WAP GAP” problem and not by WTLS as a
protocol. The next generation WAP will support the full use of
TCP/IP protocols and will use TLS for security. In WAP 2.0 the
gateway does not have to act like a translator and hence
encrypted data can remain encrypted while passing through the
gateway.
REFERENCES
Facing The challenge of wireless security – Sandra Kay Miller, Technology news
http://dlib2.computer.org/co/books/co2001/pdf/r7061.pdf
Integrated transport layer security: End-to-End security Model between WTLS and
TLS – Eun-Kyeong Kwon
http://dlib2.computer.org/conferen/icoin/0951/pdf/09510065.pdf
Professional WAP- Charles Arehart, Nirmal Chidambaram (Wrox publications)
WAP 2.0, securing the internet without wires- www.IBM.com
Plugging the GAP in WAP- E-Witness,
www.e-witness.ca/docs/plugging.pdf