Secure data transmission over wireless networks

Authentication and encryption are the core security concepts of Wireless LAN. Today, very strong security mechanisms for WLAN do exist. If proper WLAN security solutions are deployed, a wireless network can be as secure as the wired network. An 802.1X/EAP framework allows a variety of specific methods to be used for the authentication and key management procedures. There are two major sets of EAP-methods, which are password-based and certificate-based. The password-based EAP-types provide lightweight processing and are very convenient. But many of them are susceptible to the offline dictionary attacks, and hence considered weak. On the other hand, the certificate-based methods provide strong security as well as allow password-based authentication methods to be used. The certificate-based methods achieve these security properties using Transport Layer Security (TLS) Handshake protocol that establishes authenticated and encrypted tunnel. Within tunnel, password-based methods can run securely. The significant downside of certificate-based methods is the requirement of Public Key Infrastructure (PKI) which is costly to implement and hard to manage. This research's aim is an analysis of TLS-based EAP protocols used in WLAN. We have chosen only wide deployed RFC-based EAP types because of their availabilities and standards based property. We mainly focus on the EAP-FAST protocol because of its attracting security features. The EAP-FAST protocol differs from other TLS-based EAP types on using shared secret keys instead of certificates, thus significantly increasing performance. EAP-FAST provides not only the same security level as other strong TLS-based methods, but also convenience and efficiency by using PACs. We validated different authentication scenarios of EAP-FAST protocol using an AVISPA model checker.