Let's now take a look at why find networks authentication methods.
There are three authentication options access points might perform authentication without verifying
user identity.
If that's the case anybody can connect to the wireless LAN user identity can be verified through checking
if they know a shared secret user usually submitted while the client is trying to connect to the protected
network.
It's crucial that you understand that these two are completely different technologies.
One is used for authentication.
We're talking about that now.
The other ensures the confidentiality of data will cover this in the moment.
The third wireless authentication method involves the use of a radius server and Ato to 11 x protocols.
We've already talked about this set of protocols to quickly remind you in this case an access point
is configured as a radius server client using the EAP protocol the radius server forwards the client
submitted authentication credentials
the server verifies the user's identity.
If you use a radius server and the ATO to that 11 X protocol shared secrets are not used each user has
his own password.
You logs on to his account and his identity is verified.
The solution is both more secure and more functional.
The three authentication methods can be used together with various encryption methods.
Not all combinations will be a good fit.
You can try several of them
we've already mentioned open system networks that don't perform user verification.
This is a part of the ATO to dot 11 standard.
It's enough to submit the name of an open network and connect to it.
A network name field can also be referred to as an SS ID or a network identifier that signify the same
thing.
The legality of connecting to other people's open wireless networks varies depending on the country.
In the Netherlands for example an active intrusion to protect the wireless network is not considered
a crime.
It's similar for Germany while it is a crime there.
It's seen as the fault of the wireless service providers who jeopardize the safety of their customers
by providing them with insufficient protection.
In the majority of countries however it's the attacker who will be held responsible for the acts
in the case of open networks.
The identities of users and computers are verified against the MAC addresses of the network cards.
An open wireless network can also use encryption for transmitted data
what security is used for this purpose open system authentication with web key encryption means the
validity of the web keys will not be verified since frames are encrypted with this key and access point
will reject the frames that can't be decrypted.
Second protection measure is using appreciate key.
It's a hugely popular authentication method and home Rantz before I move on to describe how clients
are authenticated.
We'll talk a bit about the drawbacks of this solution if more than two persons share a secret.
It's no longer a secret or key must be submitted and all computers that want to establish a connection
with a given wireless LAN there's no mechanism for that so we do it manually That's why we will probably
never change a set key.
A shared secret which is not a secret and is never changed.
It doesn't guarantee any security will discover this.
In the second part of our module leaving aside the questions of authentication effectiveness Let's now
see how this process looks.
The technique makes use of the challenge response mechanism we already know.
A client attempts to contact a selected wireless LAN
an access point generates a pseudo random challenge message and sends it to the client.
The client has to then encrypt the received challenge with the pre-shared key.
He S-K and send the encrypted response to the access point.
Next the AP decrypts the ciphertext and compares it against the challenge challenges sent earlier if
the results match.
This means that the same key was used to encrypt and decrypt the message implying that the client was
in possession of the key and was authorized to connect the VLAN.
The system for sending challenge in response messages is not protected in any way.
Note that the key itself is not transmitted over a network.
Only the data encrypted with the key is transmitted.
When you examine threats related to Wi-Fi security it will turn out that the process can be reversed.
Or intercepting the challenge in response messages.
We can extract the P S K
since all users share the key.
All users share also medium access and those vans that use PMK user authentication.
All users have access to the same medium.
This is like being in a local area network connected with hubs packets received by all clients.
It depends on the mode used by the receivers network card to reject the packets that are an address
to it or to choose to intercept and modify them.
The only secure method for verifying wireless network user identity is provided by the use of the ATO
to daddle 11 x standard.
If you configure and access point as a radius server client you will need to submit a shared secret.
In this case the secret will be shared by the access points in the radius server and not by the x network
users.
This will allow the AP to check the identity of users who want to establish a connection.
Each person will have their own identity.
Each person will have their own secret.
For example the passwords stored in the Active Directory.
This means that the radius server will be an active directory server client.
It will forward questions usually according to this pattern first will ask whether the user who claims
to be Bob has already submitted a correct password the next request will ask for proof that a given
user is authorized to connect to an office VLAN using Wi-Fi
a more secure version of this mechanism verifies the identity of users or computers against their certificates.
This does seem very complicated.
Other than an access point you need a computer used as a radius server and also a domain controller
for this as you see the infrastructure is extensive.
This is why this solution is not generally deployed in homeland's Well it does bring a lot more security.
It's excessive if there are only three or four users in a home network.
As for business Flans with 5 or more users however I'd strongly recommend configuring a computer as
the domain controller or as a radius server will see that this solution will secure and network against
all known attacks.