noWYR
Security Methodology
Our Proprietary Protocol
noWYRs
proprietary air interface provides a strong
foundation against attacks by invaders.
First of all, because our equipment supplier's
system is based on a proprietary protocol,
there are no published specifications for
the product by which sniffer radios could
be built. In addition, a sniffer would require
their proprietary chip set that is not readily
available. Second, the MAC protocol for
packet assembly, disassembly and retransmission
is not published. Third, data transmitted
over the air is scrambled into 64-byte data
packages thus providing an additional obstacle
to unauthorized decoding. Finally, the directionality
of the system transmissions impedes eavesdropping.
In other words, the proprietary air interface
presents a major hurdle for unauthorized
parties. Of course, the systems security
is not based merely on secrecy of its air
interface.
AUTHENTICATION
Clearly it is inadvisable to transmit information
that one assumes is secure using clear text
as it can be easily monitored. Unlike many
fixed wireless broadband products, our equipment
supplier's system does not use clear text
transmissions but rather a proprietary protocol
for transmissions. When this protocol is
combined with their Authentication Manager,
an added level of security is achieved.
The Authentication Manager controls access
to the system, and each Access Point (AP)
module can be configured to require secure
Subscriber Module (SM) authentication prior
to providing network access. Each SM must
be authenticated by the Authentication Manager
before entering the network. SMs are authenticated
and keys are managed individually. The authentication
process also takes into account the electronic
serial number unique to each transceiver
along with a 128-bit secret key that is
unique to each SM and is known only to noWYR.
The eight step authentication process is
shown below.
|
Step
|
Description of Task
|
|
1
|
When an SM attempts to
enter the network it sends a registration
request to the AP. |
|
2
|
The AP then sends an
authentication request to the Authentication
Manager. |
|
3
|
The Authentication Manager
generates a 128 bit random number that
is sent to the SM as a challenge. |
|
4
|
The SM calculates a response
using either its factory set key or
the Authorization key it has been assigned
by the network operator. |
|
5
|
This challenge response
is sent to the Authentication Manager
through the AP. |
|
6
|
The Authentication Manager
compares the challenge response to what
it calculated using the same random
number and the Authentication key from
the Authentication Manager database. |
|
7
|
If the results agree,
the Authentication Manager sends the
AP a message authenticating the SM and
sends the SM and AP quality of service
information. |
|
8
|
If the results do not
agree or the SM is not in the database
the Authentication Manager sends the
AP a message denying authentication
and the AP sends the SM a message to
lock itself out from that AP for 15
minutes before retrying. |
|