The weaknesses in WiMax and what you can do about them
Connecting state and local government leaders
Agencies deploying systems using the WiMax standards for wireless networking need to be aware of the threats and security features built into the products, and NIST has released its recommendations for securing WiMax.
WiMax has evolved from a standard for wireless metro-area networking to a broader, more cellular-like architecture that includes mobile communications and multihop relays. Agencies deploying the technology must be aware of its vulnerabilities and security features to ensure secure deployment.
The National Institute of Standards and Technology has finalized a set of guidelines for securing these wireless networks, Special Publication 800-127, Guide to Securing WiMAX Wireless Communications.
Related coverage:
Wave of smart devices may drown mobile managers
Commerce to test 4G technology for public safety network
The document, originally approved in September but not published until now, covers the security of the WiMax air interface and user subscriber devices, including security services for device and user authentication; data confidentiality; data integrity; and replay protection. It does not address WiMax network system specifications, which covers core network infrastructure and are primarily employed by commercial network operators.
“Like other networking technologies, all WiMax systems must address threats arising from denial-of-service attacks, eavesdropping, man-in-the-middle attacks, message modification and resource misappropriation,” the guidelines say.
The publication explains the basics of WiMax, detailing the security differences among the major versions of the IEEE 802.16 standard, along with information on the security capabilities and recommendations on securing WiMax technologies.
WiMax threats consist primarily of compromises to the radio links between WiMax nodes. These radio links can be both line-of-sight and non-line-of-sight. Line-of-sight links generally are harder to attack than non-line-of-sight links because an adversary would have to physically locate equipment between the nodes to compromise the link.
Non-line-of-sight systems provide coverage over large geographic regions, which expands the potential staging areas both for clients and adversaries.
To secure WiMax systems, NIST recommends:
• Organizations should develop a robust WiMax security policy and enforce it. WiMax policy should address the design and operation of the technical infrastructure and the behavior of users. Client devices should be configured to comply with WMAN policies, and policy-driven software can be used to help ensure that client devices and users comply with policies.
• Organizations should pay attention to WiMax technical countermeasures before implementing a vendor’s WiMax technology. As of this writing, few WiMax products employ Federal Information Processing Standard-validated cryptographic modules. Consequently, vendors often integrate their WiMax products with other security solutions that meet FIPS requirements. WiMax interoperability certifications do not extend to these add-on approaches, which means there may be no assurance that the vendor’s offering will function as intended.
• Organizations should require mutual authentication for WiMax devices. WiMax technology supports mutual device authentication between a base station and a user’s subscriber unit, such as mobile phones, laptops, or similar devices, but the feature must be activated.
• Organizations should implement FIPS-validated encryption to protect WiMax data communications. WiMax communications consist of both management and data messages. Management messages govern communications parameters to maintain wireless links, and data messages carry the data to be transmitted. Encryption is not used with management messages for efficiency reasons, but data messages are encrypted natively according to IEEE standards. Government communications requiring encryption must use products validated under the NIST Cryptographic Module Validation Program. For solutions lacking these validations, organizations should deploy overlay encryption solutions, such as a FIPS-validated virtual private network solution.
NEXT STORY: You want the data? You can't handle the data!