NIST targets security steps for a more mobile WiMAX

The Worldwide Interoperability Standard for Microwave Access, commonly know as WiMAX, originally was a metro-area networking standard intended as a last-mile broadband access alternative, but the technology has become more flexible in the last five years.

“Developments in the IEEE 802.16 standard shifted the technology’s focus toward a more cellular-like, mobile architecture to serve a broader market,” the National Institute of Standards and Technology said in a recently released draft report on WiMAX security. “Today, WiMAX is a versatile technology that continues to adapt to market demands and provide enhanced user mobility.”

Agencies deploying WiMAX need to be aware of the vulnerabilities in and threats to the technology, and of the security features built into the products. NIST has released a draft version of Special Publication 800-127, “Guide to Security for WiMAX Technologies.”

The publication explains the basics of WiMAX, explaining the security differences among the major versions of the IEEE 802.16 standard, along with information on the security capabilities and recommendations on securing WiMAX technologies.

The original standard, IEEE 802.16-2004, was limited to fixed operations, but 802.16e-2005 allowed mobile operations as well and introduced more robust mutual authentication and support for the Advanced Encryption Standard (AES). But certification of products to the 2005 revision did not begin until 2008, so there still are many products using the original standard. The 802.16-2009 standard consolidates amendments made from 2004 through 2008, and the 802.16j-2009 standard provides a framework for multi-hop relay or mesh networking.

“Like other wireless networking technologies, all WiMAX systems are susceptible to denial-of-service attacks, eavesdropping, man-in-the-middle attacks, message modification, and resource misappropriation,” the guidelines state. “WiMAX network threats focus on compromising the radio links between WiMAX nodes.”

The links can be either line of site or non-line of site. The line-of-site links are more difficult to attack directly because equipment would have to be located directly between the nodes to compromise the signal and its data.

To secure WiMAX systems, NIST recommends:

• Organizations should develop a robust WiMAX security policy and enforce it. WiMAX policy should address the design and operation of the technical infrastructure and the behavior of users. Client devices should be configured to comply with Wireless Metropolitan Area Network policies, and policy-driven software can be used to help ensure that client devices and users comply with policies.
• Organizations should pay attention to WiMAX technical countermeasure capabilities before implementing WiMAX. Technical countermeasures are typically designed into WiMAX systems, making the design phase of implementation particularly important. Once a WiMAX system is implemented, its technical countermeasures are generally static. The technical countermeasures implemented by each WiMAX system vary widely between vendors. Before implementing a technology, an organization should consult vendors to understand potential system reconfiguration constraints and the need for compensating controls to address technical security needs.
• Organizations should require mutual authentication for WiMAX devices. IEEE 802.16e-2005 and IEEE 802.16-2009 support an array of authentication solutions to provide both device and user authentication between a base station and client subscribers. These authentication solutions can support a combination of user names and passwords, card-based tokens, biometrics, or public-key infrastructures. Organizations should strongly consider WiMAX solutions capable of supporting Extensible Authentication Protocol (EAP) methods for mutual authentication as recommended in draft NIST SP 800-120, “Recommendation for EAP Methods Used in Wireless Network Access Authentication.”
• Organizations should implement FIPS-validated encryption to protect WiMAX data communications. WiMAX uses management messages to govern parameters needed to maintain wireless links, and data messages to carry the data being transmitted. To increase efficiency, encryption is not applied to management messages of network operations, and data messages are encrypted natively in accordance with IEEE standards. IEEE 802.16e-2005 and IEEE 802.16-2009 support the FIPS-approved AES algorithm, but IEEE 802.16-2004 supports Data Encryption Standard in Cipher Block Chaining mode (DES-CBC). DES-CBC has several well-documented weaknesses and should not be used to protect data. For WiMAX solutions that do not provide FIPS-validated encryption, organizations should deploy separate encryption solutions, such as a FIPS-validated virtual private network.

Comments on the draft guidelines should be e-mailed by October 30 to 800-127comments@nist.gov with "Comments SP 800-127" in the subject line.