Subject: [Capwap] Additions #7 - Centralized WTP Management

From: "Saravanan Govindan" <[email-masked]>
Date: Mon, 10 Jan 2005 18:59:19 +0800

Additions #7 - Centralized WTP Management

Context: 

Centralized WTP Management
- Introduction (Section 7.2)
- Objective Details (Section 7.2.1)
- Motivation and Protocol Benefits (Section 7.2.2)
- Relation to Problem Statement (Section 7.2.3)
- Customer Requirements (Section 7.2.4)

Issue: 

These sub-sections were left blank in v00. 

Proposed changes: 

Add text for the sub-sections. The following are proposed;

-> Section 7.2 - Introduction

Proposed text: Add the following paragraph

"Large WLAN systems consist of a centralized CAPWAP segment and the wireless
medium segment. WTPs, their WLAN controller and the switched or routed
network between them constitute the CAPWAP segment. Wireless clients and the
air interface constitute the wireless medium segment. This objective deals
with system-wide security particularly with those threats arising from the
wireless medium segment."

----XXXX----

-> Section 7.2.1 - Objective Details (Left blank in v00)

Proposed text: 

"The emphasis of this objective is on the security threats external to the
centralized CAPWAP segment of a WLAN system. The focus is therefore on rogue
wireless clients and other illegitimate wireless interferences. There are a
number of specific external threats that need to be addressed within the
CAPWAP framework.   

i. PMK Sharing 

One aspect of this objective relates to recent discussions on PMK sharing in
the centralized CAPWAP framework. This objective highlights the need to
prevent exploitation of this ambiguity by rogue wireless clients. It is to
ensure that there ambiguities arising from the CAPWAP framework are not
cause for security breaches.

[TBD] Additional external security threats"

----XXXX----

-> Section 7.2.2 - Motivation and Protocol Benefits (Left blank in v00)

Proposed text: Add following new paragraph

"The external threat to centralized CAPWAP segments becomes increasingly
crucial given the low cost of wireless clients. Since it is relatively
inexpensive for rogue individuals to mount attacks, it is important that
WLAN systems are protected against them. Adequate mechanisms to thwart such
external threats will be of tremendous benefit to the WLAN systems
controlled and managed by the CAPWAP protocol."

----XXXX----

-> Section 7.2.3 - Relation to Problem Statement (Left blank in v00)

Proposed text: Add following new paragraph

"This objective is based on the security needs highlighted in the Problem
Statement. Specifically, the Problem Statement discusses the effects of the
shared wireless medium. This represents the external aspects of the CAPWAP
framework from which certain threats can arise. The system-wide security
objective addresses such threats in relation to the Problem Statement."

----XXXX----

-> Section 7.2.4 - Customer Requirements (Left blank in v00)

Proposed text: Add following new paragraph

"As in the CAPWAP Protocol Security objective (7.1), system-wide security
aims to strengthen confidence in those deploying large scale WLANs.
Realizing this objective will further assure service providers and
enterprises that their wireless investment includes adequate protection
against various rogue elements."

----XXXX----

_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap