A System for Securing Wireless Networks.
This article talked about the design of a secure wireless network. The designers wanted to create a wireless network that: ran under Windows 95 or NT, is compatible with the Raylink WLAN product, uses Fortezza cryptographic PCMCIA cards, provides communication between wireless hosts using Fortezza cards and wired hosts not using Fortezza cards, compatible with all Windows applications, transparent, and have minimal impact on communication performance. .
To design this system the group had to determine which level they were going to use to encrypt and decrypt packets. The group decided to use the LSP (Layered Service Provide) level. They did not use the data link level because it would have had to modify the WLAN interface driver on the interface card of all users and when drivers were updated they would have to be modified for everyone. They decided not to use the IP or TCP levels because they did not have access to the protocol source code used by Microsoft. The LSP level is below the WinSock-- an application programming interface that lets a Windows program send data over any network transport protocol-- and above the transport layer. The LSP was developed by Intel to provide a way in which third party vendors could insert new capabilities into the protocol stack without altering applications or the network kernel. This level provided the transparency needed with the least amount of maintenance. .
The LAN-Lock system uses Fortezza cards to hold and use keys for authentication. The Fortezza cards must be activated using a GUI. Users enter a username and PIN into the GUI. The Fortezza cards then use the unique x.509 certificates to request keys from the Key Generator (KG). The KG authenticates the wireless host, wraps the key based on the certificate ID, and issues a "wrapped" key to the host based on certain rights the user has. Only the Fortezza card with the correct certificate ID can unwrap the key, which means that when a key is being used, if it can successfully encrypt or decrypt data, authentication is implicit.
