The wireless tightrope: an economical, secure, and user friendly approach for the wireless campus

ABSTRACT

Integrating a new medium for reading emails, accessing the internet, and student data wirelessly in our existing campus environment seemed to be an insurmountable endeavor. The criteria for accomplishing this feat included the following three key elements; let's do it cheap, let's make it secure, and let's make it easy to use for students and staff of all skill levels. The ultimate goal was to achieve this balance, while covering 7 "Hot Spots", 74 buildings, and 61 classrooms which encompass all 34 sq acres of our campus. Another goal of our wireless initiative was to make it useable for PC, MAC, and Linux clients. For a school of our size (1000+ students) we would have to proceed diligently.This is where the tightrope appears, how are we able to protect our students and staff, while offering a system that is easy and affordable. Most "CLOSED" wireless networks require special hardware (smartcards, or specifics NIC's) or 3rd party software installed on the client. Most "OPEN" wireless networks run on insecure protocols such as WEP.This paper will detail our traversal of this tightrope, and how we achieve this fine balance of security, usability, and cost effectiveness. We will outline the survey, authentication, roaming, security, cryptography, back-end services, and the myriad of hardware choices for access-points. The goal of this paper is to tell our story of the good, bad, and ugly of the wireless tightrope.

REFERENCES

• 1: IEEE Port-Based Network Access Control http://standards.ieee.org/getieee802/download/802.1X-2001.pdf
• 2: Cisco LEAP http://www.cisco.com/warp/public/cc/pd/witc/ao350ap/prodlit/1515_pp.htm
• 3: Microsoft TechNet The Cable Guy http://www.microsoft.com/technet/community/columns/cableguy/cg0702.mspx
• 4: RFC 2716 EAP-TLS http://www.faqs.org/rfcs/rfc2716.html
• 5: Tom's Networking http://www.tomsnetworking.com/Reviews-36-ProdID-WAP54G.php
• 6: Cisco Aironet 1200 series http://www.cisco.com/en/US/products/hw/wireless/ps430/index.html
• 7: AirSnort Homepage http://airsnort.shmoo.com/
• 8: FreeRADIUS http://www.freeradius.org/
• 9: OpenSSL http://www.openssl.org/
• 10: OpenLDAP http://www.openldap.org/
• 11: Internet Authentication Service http://www.microsoft.com/windowsserver2003/technologies/ias/default.mspx
• 12: Cisco WDS Service http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_example09186a00801c951f.shtml
• 13: Cisco WLSE http://www.cisco.com/en/US/products/sw/cscowork/ps3915/products_user_guide_book09186a00801f3c71.html

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.1 Network Architecture and Design

Additional Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Unauthorized access (e.g., hacking, phreaking); Authentication

General Terms:
Design, Economics, Management, Security, Verification

Keywords:
802.1X, EAP-TLS, MSCHAPv2, PEAP, SSL certificates, SWAN, WEP, WLCCP