Service Announcements for Hot-Spots: Enabling Automated Access and Provider Selection for (WLAN-based) Voice Upperside WiFi Voice 2005

Transcription

1 Service Announcements for Hot-Spots: Enabling Automated Access and Provider Selection for (WLAN-based) Voice Upperside WiFi Voice 2005 Jörg Ott Dirk Kutscher Jörg Ott Dirk Kutscher 1 Overview Brief Introduction to Telephony in WLANs WLAN Hot-spot Setups Autoconfiguration Hot-Spot Authentication Simple Heuristics for Hot-spot Access WiFi Alliance Smart Client Authentication Procedure Service Announcements using Internet Media Guides (IMGs) Conclusion 2005 Jörg Ott Dirk Kutscher 2

2 Session Initiation Protocol (, RFC 3261) Initiate, terminate, and modify sessions Multimedia(!) sessions (not just voice!) Point-to-point and multiparty Support for Caller and callee authentication / call authorization Privacy for call signaling and media streams Media path with ensured QoS Policy-based control mechanisms Flexible service creation End-to-end principle ( dumb network ) Support through servers (located anywhere) Extensible protocol to cover new communication aspects Such as presence and instant messaging 2005 Jörg Ott Dirk Kutscher 3 Terminology User Agent User Agent (UAS) User Agent Client (UAC) User Agent = Endpoint, Gateway Registrar Location Redirect Proxy Back-to-Back (B2B) User Agent IP Telephony Application s 2005 Jörg Ott Dirk Kutscher 4

3 Local Architecture sip:tzi.org Redirect / Proxy Endpoint IP Telephony ( ) Location Endpoint Registrar Local IP network Endpoint Gateway Gateway Gateway PSTN ISDN GSM H.323 UA UA UA 2005 Jörg Ott Dirk Kutscher 5 Global Architecture Endpoint backbone network Provider X domain Endpoint signaling for initial call routing and setup in-call signaling RTP media streams Endpoint Local domain Provider Y domain Endpoint 2005 Jörg Ott Dirk Kutscher 6

4 Simple Scenario of a Call Calling Bob I am Bob, please route calls to my current address... Incoming call from Alice 3 Alice 4 Bob Call signaling Media streams 2005 Jörg Ott Dirk Kutscher 7 Proxied Call tzi.org alice@ruin Lookup sip.bar.com User Lookup bar.com bob@foo INVITE sip:bob@bar.com 100 Trying 200 OK INVITE sip:bob@foo.bar.com 100 Trying 200 OK ACK Media Streams Subsequent requests 2005 Jörg Ott Dirk Kutscher 8

5 Relevant Characteristics registrations are essential for reachability Require periodic refresh and persistent addresses between refreshs Other messages Call control carries information about RTP media streams, possibly keys Other messages may also carry data (e.g. MESSAGE) may use TLS for hop-by-hop security phone to trusted server messages may be encrypted end-to-end servers cannot see the contents messages may be authenticated end-to-end servers cannot modify the contents 2005 Jörg Ott Dirk Kutscher 9 Phones Support autoconfiguration For IP stack parameters, time, servers User preferences Support STUN/TURN/ICE for NAT/firewall traversal Communicate directly with their trusted server (using TLS) For outbound and inbound calls Configuration usually easy only via browser Done once and then preferences are stored No need to touch during regular operation 2005 Jörg Ott Dirk Kutscher 10

6 Examples for (S)IP WLAN phones 2005 Jörg Ott Dirk Kutscher 11 DSL Router w/ access Point Typical Hot-Spot Setup ISP Internet WLAN access points WLAN user The friendly home user Access controller Switch WAN router Commercial hot-spot ISP AAA server WISP Internet 2005 Jörg Ott Dirk Kutscher 12

7 Autoconfiguration Scan radio channels for access points Determine SSIDs and modes of operation Device needs to obtain IP stack configuration IP address + netmask Default router (usually access point) Domain name suffix Perform functions specific to IP telephony Determine the presence of NATs Obtain publicly usable addresses (STUN, TURN, ICE) for RTP media Update registration with new contact information Authenticate with telephony service provider 2005 Jörg Ott Dirk Kutscher 13 Hot-Spot Access Protecting WLAN hot-spots against unauthorized access For privacy protection For billing purposes For legal reasons (accountability) Hot-spot access control Open (just works but IP autoconfiguration needed) WEP-based (well, need to determine key from SSID) Wi-Fi Alliance Universal Access Method (UAM) commonly used 802.1X &.11i (coming up) IPsec and PPTP (sometimes; needs to be known in advance) Issue: manual process not suitable for WLAN IP phones Determine what is used, who is the service provider, 2005 Jörg Ott Dirk Kutscher 14

8 UAM Overview (1) Radio detection L2 Association DHCP autoconfiguration 2.3s DNS request [ DNS response HTTP GET Moved Temporarily Contact: s DNS request [hs.access.com] DNS response 2005 Jörg Ott Dirk Kutscher 15 UAM Overview (2) HTTP GET 1.5s 200 OK Login page + form User enters auth credentials HTTP POST user= password= 200 OK Confirmation + logout page Backend authentication & authorization 0.5 3s DNS request [ DNS response Internet Total: 5 7s HTTP interactions 2005 Jörg Ott Dirk Kutscher 16

9 IEEE i IEEE i IEEE 802.1X-based authentication with EAP Supersedes IEEE WEP-based security Extensible Authentication Protocol (EAP) Media-independent framework for network access authentication RFC 3748: EAP over PPP IEEE 802.1X: EAP over wired IEEE 802 networks IEEE i: EAP over IEEE IEEE i 3 phases: 1. IEEE association 2. IEEE 802.1X EAP authentication 3. 4-Way Handshake and Group Key Handshake 2005 Jörg Ott Dirk Kutscher X EAP Authentication Station Authenticator Authentication 802.1X EAP Request 802.1X EAP Response EAP Authentication Protocol Exchange Acces Request (EAP Request) Accept / EAP Success / Key Material 802.1X EAP Success 2005 Jörg Ott Dirk Kutscher 18

10 IEEE i 4-Way Handshake Station Authenticator Pairwise Master Key is known. Generate SNonce Derive Pairwise Transient Key ANonce Snonce + Message Integrity Code Pairwise Master Key is known. Generate ANonce Group Temporal Key + Message Integrity Code Derive Pairwise Transient Key ACK 2005 Jörg Ott Dirk Kutscher 19 Scan for signal Authentication Heuristics Obtain SSID, security params L2 open? yes Internet Access? yes Done no no no SSID known? yes yes no Shared Key? no i? yes no WISP known? WISP known? yes yes no UAM Auth i Auth. Config Keys 2005 Jörg Ott Dirk Kutscher 20

11 Evaluating Autoconfiguration and Authentication Prototype Implementation ConnectivityDetector: monitors WLAN link, sends triggers Enhanced DHCP client: receives triggers and timely initiates DHCP AutoAuthenticator: when triggered performs UAM authentication tcpx test tool: data transfer as soon as connectivity established Controlled tests with experimental setup on the road tcpx (client) NoCat DHCP Srv. satnat tcpx AAA Srv. Mobile Node Access Point Access Router Link Simulator Fixed Node Real-world tests with real-world hot-spots: mixed success 2005 Jörg Ott Dirk Kutscher 21 Observations with Real-World Hot-Spots If it works: authentication usually done in less than 10s But: Hot-spots are often a little but not entirely unlike UAM Deviation from UAM web page structure Initial overview pages with a link to a login page Need to find and follow the link requires further second-guessing Deviation from UAM field structure and names Slightly or totally different names Additional fields to fill in (e.g., checkbox for terms and conditions) Multiple service providers to choose from JavaScript code, etc. in web pages Requires more effort to parse and evaluate 2005 Jörg Ott Dirk Kutscher 22

12 First Step: WiFi Alliance Smart Clients Use machine-readable format for authentication procedure XML-based data structures ( hidden in HTML page!) Otherwise, follow the same approach as UAM as above Use TLS Redirect message provides details about hot-spot and operator Login and logoff URIs, location Subsequent authentication exchange User name, password, Abort and logoff messages Still no well-defined multi-provider support 2005 Jörg Ott Dirk Kutscher 23 Sample WISP Service Offer <?xml version="1.0" encoding="utf-8"?> <WISPAccessGatewayParam xmlns:xsi= xsi:nonamespaceschemalocation= " <Redirect> <AccessProcedure>1.0</AccessProcedure> <AccessLocation>12</AccessLocation> <LocationName> ACMEWISP,Gate_14_Terminal_C_of_Newark_Airport </LocationName> <LoginURL> <AbortLoginURL> </AbortLoginURL> <MessageType>100</MessageType> <ResponseCode>0</ResponseCode> </Redirect> </WISPAccessGatewayParam> 2005 Jörg Ott Dirk Kutscher 24

13 Issue: User Policy for Access Hot-spot tariff models mostly time-based Very coarse granularity Users pay per half hour or hour But even per minute charges are of little use Flat rates still uncommon User to pay for her phone automatically registering? User policy Which provider to accept, which ones to prefer e.g., flat-rate only automatically, others inquired Hot-spot support for (S)IP phones? Proxy for registration messages only risk of misuse (IP-over-?) Security aspect no TLS to trusted server, user becomes visible 2005 Jörg Ott Dirk Kutscher 25 Internet Media (and Service) Guides Delivery framework Multicast announcements FLUTE: Reliable multicast Workable in broadcast networks(!) Individual retrieval and asynchronous notifications + HTTP Full descriptions (arbitrary size, not limited to MTU) or deltas Description Envelope format for content identification, versioning, security Intended for media descriptions (e.g., electronic program guides) May carry arbitrary data (to be defined elsewhere) Allows embedding WiFi Alliance <WISPAccessGatewayParam> 2005 Jörg Ott Dirk Kutscher 26

14 Adding Services to IMGs Expand on a general hot-spot definition Allow for multiple service providers Embed WiFi alliance redirection reply as part of the announcement Add explicit information about WISP, tariff, etc. Include information about roaming charges Add hot-spot-specific services (e.g., telephony proxying without charge) Add regional services e.g., ITSPs with local terminations Add geo information (e.g., GPS) Enable drawing up a map of a region, city, quarter, Gained from combining local + global announcements Allow for advance retrieval and caching 2005 Jörg Ott Dirk Kutscher 27 Conclusions Only few hot-spots are really UAM compliant Variable naming of username and password fields, etc. Sites with multiple Wireless Internet Service Providers Determining wireless services difficult WISP identities, tariff models, etc. User policies important for reasonable access models Enhanced service announcements More detailed information about the current hotspot Enable smart decisions for smart clients Explicit service support for IP telephony in hot-spots desirable 2005 Jörg Ott Dirk Kutscher 28