Presentation on theme: "Enterprise Wireless LAN (WLAN) Management and Services"— Presentation transcript:
1 Enterprise Wireless LAN (WLAN) Management and Services Jitu Padhye(Joint work with Ranveer Chandra, Alec Wolman, Brian Zill & Victor Bahl)
2 Wireless Network WoesCorporations spend lots of $$ on WLAN infrastructureWorldwide enterprise WLAN business expected to grow from $1.1 billion this year to $3.5 billion in 2009Wireless networks perceived to be “flaky”, less secureMicrosoft’s IT Dept. logs several hundred complaints / monthUsers complain about:Lack of coverage, performance, reliabilityAuthentication problems (802.1x protocol issues)Network administrators worry aboutProviding adequate coverage, performanceSecurity and unauthorized accessDefCon 2005 : WiFi Pistol, WiFi Sniper Rifle, WiFi Bouncing, AirSnarf boxBetter WLAN management system needed!2
3 Requirements for a WLAN Management System Integrated locationserviceMobile ClientsProblems may be location-specificMultiple monitorsDense deploymentComplex signal propagation in indoor environmentMany orthogonal channelsAsymmetric linksManagement system consists of a monitoring subsystem that gathers data, inference engine that processes it and then takes action.Wireless presents challenges for gathering and processing dataScalableSelf-configuringCope with incompletedata
4 State of the ArtAP-based monitoring (Aruba, AirDefense, ManageEngine …)Pros: Easy to deploy (APs are under central control)Cons:Can not detect coverage problems using AP-based monitoringSingle radio APs can not be effective monitorsLimited coverage even with dual-radio APsMS IT currently uses dual-radio APs from ArubaSpecialized sensor boxes (Aruba, AirTight, …)Pros: Can provide detailed signal-level analysisCons: Expensive, so can not deploy denselyMonitoring by mobile clientsResearch MSR [Adya et. al., MobiCom’04]Pros: Inexpensive, suitable for un-managed environments (Ranveer’s talk).Coverage not predictable (clients are mobile)Lack of densityBattery power may become an issueOnly monitor the channel they are connected onAruba system works, but not clear how effective it is. Supposed to detect rogue APs. They found one recently – it was deployed by another group on our floor, but they have never detected ours – we have been doing this for good six months!Mo
5 + Observations DAIR: Dense Array of Inexpensive Radios Desktop PC’s with good wired connectivity are ubiquitous in enterprisesOutfitting a desktop PC with wireless is inexpensiveWireless USB dongles are cheapAs low as $6.99 at online retailersPC motherboards are starting to appear with radios built-in+Leverage desktops to become wireless monitorsCombine to create a dense deployment of wireless sensorsDAIR: Dense Array of Inexpensive RadiosDetails: HotNets’05, MobiSys’06
6 Key Characteristics of DAIR High sensor density at low costEffective monitoring of multiple channels in indoor environmentsTolerates failure of a few sensorsLeverages existing desktop resourcesSensors are stationaryProvides predictable coveragePermits meaningful historical analysisMakes it easier to build an integrated location serviceAccuracy improves with sensor densityCompletely self-configuringEase of deploymentTo reiterate, the key characteristics of DAIR are …Self configuration is not a direct consequence of the basic idea. Rather, it is a need (due to high sensor density), and we have explicitly designed our system to be so.6
7 DAIR Architecture AirMonitor AirMonitor Land Monitor Wired Network SummarizedDataCommandsWired NetworkCommandsand DatabaseQueriesFour main components: AirMon, LandMon: use wired services like DHCP, ex, Database, InferenceAirMonitors: wireless sensors. Primarily passive, in certains cases generate active trafficLandMonitors: wired sensors. One per subnet.Inference engine: queries database, performs complex, cpu intensive computations.Database: goal is to support a small # of 100’s of clients per databaseData fromdatabaseData toinference engineSummarized datafrom MonitorsOther data:SNMP,ConfigurationInferenceEngineDatabase
8 Monitor Architecture Extensibility : new task = new filter Filters summarize what they hear, periodically submit summaries to a db server. Filter for Rogue wireless detection summarizes SSID and BSSID information.All support modules make the filters simple to write.8
9 Managing Existing WiFi Networks using DAIR Security ApplicationsDetect Rogue APs, DoS attacksResponse:Locate AP, Inform netopsLaunch DoS attacks against Rogue APsPerformance managementMonitor RF coverage: Detect poor coverage, RF holesLocate region of poor coverageProvide temporary coverage until an AP can be installedLoad balancing: Detect overload, congestion, flash crowd, rate anomalyDAIR nodes temporarily serve as APs or repeatersReconfigure AP power levels (cell breathing)Location service to support above applicationsTold you about challenges, now let’s look at some specific applications. We have already built blue ones..And we have built a location service to support these apps.
10 Overview of location service Distinguishing features:Self-configuringCan locate un-cooperative transmitters (e.g. unauthorized APs)Office-level accuracyHow it works:AirMonitors locate themselvesAirMonitors regularly profile the environment to determine radio propagation characteristicsInference engine uses profiles and observations from multiple AirMonitors to locate clients, sources of interference (DoS attack?), determine regions of poor performanceMany wireless location systems have been proposed.
11 Example Application: Detecting Rogue AP Problem:Careless employee brings AP from home, attaches it to the corporate networkBypasses security measures like 802.1x, allows unauthorized clients to gain accessOnce rogue network is installed, physical proximity is no longer neededSimple solution: (state of the art)Build database of authorized SSIDs (Network Names) and BSSIDs (AP MAC Addresses)Whenever an unknown entity appears (either SSID or BSSID), raise alarmFalse positives:Reason: Shared office buildingSolution: determine whether suspect AP is connected to corporate wired networkArray of tests: association test, src/dst address test, replay testFalse negatives:Reason: Malicious user configures rogue AP with valid SSID/BSSIDSolution: use location and breaks in packet sequence numbers to disambiguateTrivial to create a rogue ad-hoc network with a desktop machine11
12 Current deployment Testbed: 40 nodes on one floor Operational since Nov’05NetGear USB Wireless AdapterCustom driverDatabase server: MS SQL 2005 on 1.7GHz P4 with 1GB RAMInference engine server: 2GHz P4 with 512MB RAMNodes submit summary data every 2 minutes (randomized)Inference engines query data every 1-3 minutes
13 One database server per building should be sufficient. System ScalabilityLoad on database server < 75%Additional load on desktops < 2-3%Wired network traffic per node < 5KbpsOne database server per building should be sufficient.
16 See 2 & 3 during break after the talk Demo …..Rogue AP detection and locationDoS attack (Disassociation attack) detection and locationLocation-aware client performance monitoringSee 2 & 3 during break after the talk
17 How do AirMonitors locate themselves? Monitor machine activity to determine primary userLook up ActiveDirectory to determine office numberParse office map to determine coordinates of the officeVerify and adjust coordinates by observing which AirMonitors are nearby
18 Profiling the Environment to build a Radio Map Each AirMonitor periodically transmits beaconsRepeat for various channels, power levels, various times of dayOther AirMonitors record signal strengthInference engine fits curve(s) to collected observationsThe curve is a compact and approximate representation of the radio propagation characteristics of the environment802.11a (5GHz)Normal office hours3rd floor of building 11233 AirMonitors
19 Determining location of clients (any “transmitter”) AirMonitors capture packets from the client, report observed signal strength of databaseInference engine:Selects appropriate profile (frequency, time of day)Locates client using the observations from AirMonitors and the profileSpring-and-ball algorithm for fast convergence