This paper describes a new Internet access paradigm based on Lowest Cost Denominator Networking - the Public Access WiFi Service (PAWS) - that utilises the unused capacity of home broadband connections and provides users who are unable to afford paying for the service with Less-than-Best-Effort access to these resources. We identify the security and architectural challenges faced by the project and propose our solution that enables free internet connectivity to public services for the local community, in a secure and scalable manner

Christian Greiffenhagen (1254093)

Derek McAuley (7188776)

Heidi Howard (7189688)

Jon Crowcroft (7188773)

Milena Radenkovic (7188779)

Murray Goulden (4685869)

Richard Mortier (6474849)

English

Loughborough University Institutional Repository

Providing Security for Wireless Community NetworksMilena RadenkovicMurray GouldenDerek McAuleyRichard MortierUniversity of Nottingham, UKfirst.last@nottingham.ac.ukHeidi HowardJon CrowcroftUniversity of Cambridge, UKfirst.last@cl.cam.ac.ukChristian GreiffenhagenLoughborough University, UKc.greiffenhagen@lboro.ac.ukABSTRACTThis paper describes a new Internet access paradigm basedon Lowest Cost Denominator Networking - the Public AccessWiFi Service (PAWS) - that utilises the unused capacity ofhome broadband connections and provides users who areunable to afford paying for the service with Less-than-Best-Effort access to these resources. We identify the security andarchitectural challenges faced by the project and proposeour solution that enables free internet connectivity to publicservices for the local community, in a secure and scalablemanner.Categories and Subject DescriptorsC.2.0 [General]: Security and protection; C.2.1 [NetworkArchitecture and Design]: Wireless communication;C.2.3 [Network Operations]: Public networksKeywordsLess Than Best Effort Networks, Security, Community Net-works1. INTRODUCTIONThe Public Access WiFi Service (PAWS)[7] aims to en-able digital inclusion of under-privileged members of societythrough ensuring secure access for all to everyday online ser-vices. These are currently enjoyed by the majority but aretypically not accessible to those who come from poorer back-grounds and deprived areas. Ensuring that all members ofsociety are able to participate fully in the Digital Economyis a significant step towards improving social equality.Related initiatives in the past have assumed that all usersof the Wireless Community Networks are either sharers(share their bandwidth with other users) or pay to becomeusers. Companies such as FON [4] have been very success-ful in attracting a large community of users, with 8 millionFON hotspots currently available. This demonstrates thatbroadband customers are willing to volunteer to share theirPermission to make digital or hard copies of part or all of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage, and that copies bear this notice and the full ci-tation on the first page. Copyrights for third-party components of this work must behonored. For all other uses, contact the owner/author(s). Copyright is held by theauthor/owner(s).LCDNet’13, September 30, 2013, Miami, Florida, USA.ACM 978-1-4503-2365-9/13/09.http://dx.doi.org/10.1145/2502880.2502890.high-speed broadband Internet connection for free with fel-low citizens. Since we are considering those do not currentlyhave access to these services, we are likely to have many vul-nerable internet users. We argue that it is essential to pro-vide easy-to-use service with better-than-average security tothem.2. REQUIREMENTSInspired by Lowest Cost Denominator Networking [6],PAWS provides free internet services to users over a wire-less network that they neither own nor can control. Themajority of PAWS users will come from digitally-excludedbackground and so we need to provide better-than-averagesecurity for them. We are therefore faced with some interest-ing security and infrastructure challenges that our solutionmust address:• Confidentiality: Users need to be able to access theinternet securely without worrying about the possibil-ity that the sharers or other users on the network mayeavesdrop on their traffic. PAWS users must be pro-tected from either other PAWS users connected to thesame hotspot or from any other wireless users withinreach. As all PAWS user traffic is routed throughequipment located inside sharers’ homes, to whichsharers have full access, the PAWS user traffic needs tobe reliably protected from interception or eavesdrop-ping.• Ease-of-Use: Without any special training, usersneed to reliably use a secure connection and sharersneed to be able to set up the PAWS hotspot.• Priority: Sharers’ internet use must not be noticeablyaffected by sharing their connection with the PAWSnetwork.• Authentication, Authorisation & Accounting:The PAWS project need to be able to control whichusers are allowed to access what services, how muchof the resources to use and to be able provide detailedrecord of services accessed and resource usage.• Scalability: The PAWS network must be scalableacross deployment areas.3. PROPOSALOur proposal is designed to achieve secure end to end net-work access over unsecured network infrastructure. We re-alise this by enabling users to connect to a dedicated PAWSWiFi router on the sharer’s network and on top of this con-nection establish a secure VPN tunnel from the user’s deviceto the PAWS VPN service, using federated identity manage-ment. We describe our approach in more detail below.Hotspot DeploymentPAWS works by using a separate dedicated router connectedvia Ethernet to the sharer’s domestic router so that no fur-ther set-up is required.Alternatively we could connect the PAWS router directlyto the sharer’s internet connection and then connect thesharer’s router to the PAWS router, this would have the ad-vantage that we can accurately measure the sharer’s networkusage and therefore infer the unused capacity that could bemade available to the PAWS network. However, this wouldnot work for many reasons: The PAWS router would have towork as a modem therefore would have to be configured andsuitable for all ISPs and connection methods (fiber, ADSL,etc.). Many ISPs will not provide support if the router theyprovide is not used and thus would create another barrierfor volunteers. The original router would have to be recon-figured so as to no longer act as a modem requiring guidesavailable for PAWS sharers.FON [4] uses a dedicated router (”La Fonera”), which isconnected behind the sharer’s modem but then the shareruses the FON box as their AP for their home network. Thisis not a feasible option for us as it requires the sharer toconnect all their devices to the new AP. Existing works [1][2] implement this purely in client side software; it is not asuitable solution due to the range of devices that we intendto support.We deploy PAWS Access Points in volunteers’ houses, ad-vertising an open WiFi network with ”PAWS” SSID. ThePAWS Access Points are configured to use only a fraction ofthe sharers’ bandwidth so that sharers’ internet use is notnoticeably affected. The users’ devices connect to the PAWSadvertised network.ConfidentiallyAs outlined in the requirements above PAWS user trafficneeds to be reliably protected both while wireless and whilebeing routed through sharers’ homes.While WiFi encryption is typically considered to be theobvious option for securing the wireless traffic between theuser device and the PAWS wireless router, it cannot reliablyprovide the required level of confidentiality. Existing re-search shows that the majority of available WiFi encryptionalgorithms such as WEP, WPA, WPA2, are not sufficientlysecure. Arguably one of the latest encryption algorithmssuch as WPA2-Enterprise should be able to offer adequateencryption, however the WiFi networks suffer from a majordrawback as they are designed to provide security againstoutsiders but not among insiders. WPA2 can perform sat-isfactorily against users who do not have a valid passwordand cannot associate legitimately to the network SSID, butit does not prevent already associated users from eavesdrop-ping on newly associating users’ initial handshakes and in-tercepting their keys.In home or enterprise environments this is little cause forconcern as it can be assumed that sufficient degree of trustexists among connected users.In the case of PAWS, no trust can be assumed amongusers, and ensuring users associated with the same networkSSID cannot eavesdrop on each-other’s traffic is a majorconfidentiality requirement.The second confidentiality requirement is ensuring thatsharers cannot eavesdrop on PAWS users traffic. The PAWSWiFi routers are connected to the sharers’ routers and allPAWS users traffic can be eavesdropped at this point [5].The sharers also have physical access to the PAWS WiFirouters and there is nothing that we can practically doto prevent them from taking over these routers. Even ifthe sharers lack technical expertise to obtain administrator-level privileges to the PAWS WiFi routers, they can easilyturn them off and advertise the ”PAWS” SSID via their ownrouters.Encrypting sensitive traffic at the PAWS users’ devicesaddresses the confidentiality requirements listed above butPAWS users cannot be assumed to be able to do this them-selves.We, therefore, propose to use a VPN tunnel between thePAWS users’ end devices and a secure endpoint, so that usertraffic is not vulnerable while traversing the unsecured link.The VPN servers for the PAWS network are located nearto each geographical area that the PAWS network is de-ployed, to minimise latency. Each PAWS VPN server couldbe funded by the local council or charities.We have designed the VPN servers to provide the L2TPand PPTP protocol implementations because they offer thebest trade-off between security, ease of set-up, and built-indevice and OS support. Most computers and mobile deviceshave built-in support for L2TP and PPTP which is a ma-jor benefit for the PAWS targeted user-base. More secureVPN protocols and implementations exist but they requireadditional installation and complicated configuration.Authentication, Authorisation, AccountingAs highlighted in the requirement section, we need authenti-cation, authorization and accounting for the users connect-ing to public services via the PAWS network. We have cho-sen RADIUS network protocol because it is popular and iswell supported by a wide range of operating systems anddevices.We configured the PAWS router firewall to only allow con-trol protocols and traffic to the local PAWS VPN server fortwo reasons. First the user initiates a VPN session to thelocal PAWS VPN server and provides their PAWS creden-tials. The VPN server checks the credentials with the localRADIUS instance that confirms if the user has been authen-ticated and is authorised to establish a VPN session.In the case that the PAWS RADIUS server uses exter-nal RADIUS servers (e.g. Government, Council, Library,Bus Operator) for authentication, the PAWS authenticationserver proxies the request to the external server. The ex-ternal RADIUS server confirms the password validity. TheRADIUS Authentication Server completes the VPN session,authorises the client and starts acting as a router to theWireless Client. The user can now access the internet. Thisis shown in Figure 1 (Nottingham).Our infrastructure is highly scalable and can efficientlymanage user mobility, roaming and federated identity man-agement utilising the forwarding of authentication requestsby RADIUS to another RADIUS server (Figure 1). Considera case when a Nottingham PAWS user travels to Manch-ester and connects to a Manchester sharer’s PAWS routerand provides their PAWS username (using the RADIUS for-mat ”user@Nottingham”) and password to the ManchesterPAWS VPN server. The Manchester PAWS VPN Server for-PAWS RouterVPN ServerRADIUS ServerNottinghamExternalRADIUS ServerUser DevicePAWS RouterVPN ServerRADIUS ServerLondonExternalRADIUS ServerUser DevicePAWS RouterVPN ServerRADIUS ServerManchesterExternalRADIUS ServerUser DeviceUser Device12 3456781234 7568 9 10Figure 1: Federated Authenticationwards the username and password to the Manchester PAWSRADIUS server for authentication. The Manchester PAWSRADIUS Server determines, based on the Realm in the user-name, that it needs to proxy the authentication requestto the Nottingham PAWS RADIUS Server. The Notting-ham PAWS RADIUS Server responds back to the Manch-ester PAWS RADIUS server and confirms the username andpassword are authorised. The Manchester PAWS RADIUSserver forwards the confirmation to the Manchester PAWSVPN server. The Manchester PAWS VPN server confirmsto the client that the username and password are correctand proceeds with establishing the PAWS VPN connection.4. DISCUSSIONCurrent laws controlling the sharing of wireless internetaccess are hindering the digital economy and the digitalsocial inclusion plans of Governments [3] [9] because theyrefuse to recognize the novelty of socially transformativetechnology. For example many ISPs currently specify intheir terms and conditions that they shall be entitled toterminate the Service if they discover that customers havepermitted (whether knowingly or not) a third party to accessthe Service using a wireless connection over their communi-cations line.The law should be clarified to help spread broadband ac-cess more widely. At present many theories of law existthat are trying to address the problem of internet sharingregulation but they are still not managing to fuse their un-derstanding of human, technological, and business aspects ofinternet regulations [3]. They aim to achieve one coherenttheory that would offer a flexible, responsive and effectiveregulatory model for bandwidth sharing in cyberspace. Weargue that the impact of the introduction of community net-works on the primary traffics needs to be studied further inorder to be fully understood. Virtual Public Networks [8]addresses many of the challenges faced by PAWS, whilst alsoallowing third party stakeholders as ISPs.5. FUTURE WORKAt present the PAWS project has active deployments in adigitally deprived area in Nottingham. Further deploymentsto explore other applications will take place with fundingfrom the DE dot.rural 1 Research Hub at Aberdeen Univer-sity.6. ACKNOWLEDGMENTSThis work was supported by the EPSRC GrantEP/K012703/1. We would like to thank Arjuna Sathiasee-lan and Professor Fairhurst for there comments and feed-back.7. REFERENCES[1] Whisher wifi sharing community. www.whisher.com.[2] X. Ai, V. Srinivasan, and C. Tham. Wi-sh: A simple,robust credit based wifi community network. InINFOCOM 2009, IEEE, pages 1638–1646, 2009.[3] M. Gilen. Lawyers and cyberspace: Seeing theelephant. In 9:2 SCRIPTed 130, 2012.[4] Fon Ltd. Offical FON International CommunityWebsite. corp.fon.com.[5] N. Sastry, J. Crowcroft, and K. Sollins. Architectingcitywide ubiquitous Wi-Fi access. In HotNets:Proceedings of the 6th Workshop on Hot Topics inNetworks, 2007.[6] A. Sathiaseelan and J. Crowcroft. LCD-Net: LowestCost Denominator Networking. In ACM SIGCOMMComputer Communication Review, April 2013.[7] A. Sathiaseelan, J. Crowcroft, M. Goulden,C. Greiffenhagen, R. Mortier, G. Fairhurst, andD. McAuley. Public Access WiFi Service (PAWS). InDigital Economy All Hands Meeting, Aberdeen, October2012.[8] A. Sathiaseelan, C. Rotsos, C.S. Sriram, D. Trossen,P. Papadimitriou, and J. Crowcroft. Virtual PublicNetworks. In 2nd European Workshop on SoftwareDefined Networking (EWSDN), October 2013.[9] D. M. Sithigh. Law in the last mile: Sharing internetaccess through wifi. In 6:2 SCRIPTed 355, 2009.1http://www.dotrural.ac.uk/

Providing security for wireless community networks

https://repository.lboro.ac.uk/articles/Providing_security_for_wireless_community_networks/9479171/files/17103992.pdf

Providing security for wireless community networks

Abstract

Similar works

Full text

Available Versions

Loughborough University Institutional Repository