Aerohive Networks Inc. of Santa Clara, Calif. has introduced for its wireless LAN products a pre-shared encryption key that it says is more secure and easier to administer than the option in enterprise Wi-Fi Protected Access 2 (WPA2), the widely used industry specification for WLAN security.
The new Private Pre-Shared Key (Private PSK) system creates and manages encryption keys for a range of Wi-Fi clients, such as phones and barcode scanners and similar mobile devices that can’t support the IEEE 802.1x authentication infrastructure, including Extensible Authentication Protocol (EAP), stipulated in WPA2. No new client-based code is needed. Private PSK can also be used to quickly secure access for visitors and guest users on the corporate LAN.
It’s very similar to the Dynamic PSK technology introduced in 2008 by Ruckus Wireless to solve the same problem: creating improved enterprise-grade security where reliance on the full panoply of public key infrastructure and RADIUS servers isn’t possible or feasible.
Devin Akin, co-founder and CTO of CWNP, an Atlanta-based company that offers a WLAN certification for IT professionals, is a fan of both the Ruckus and Aerohive innovations. In a recent blog post, he rhapsodized over the simplicity of new Aerohive Private PSK. “If you want to make a personal login for your friend Mark Elliott, then you create a user for him within the manual PPSK feature, assign Mark to a group, generate (or manually enter) a PSK [passphrase], and voila – you’re done,” he writes. “You want to revoke a user because he left the company? No problem…one click. I think I’m in love.”
Like the Ruckus offering, Areohive’s Private PSK system is an alternative to Wi-Fi Protected Access Pre-Shared Key. WPA is the Wi-Fi Alliance specification for improved WLAN security, with WPA2 Enterprise mandating the use of 802.1x, AES, and the other elements of the IEEE 802.11i specification. (An Alliance white paper on enterprise WPA/WPA2 deployments is available for download here.)
The WPA Pre-Shared Key, in effect a user password, is intended for relatively small WLAN deployments, and doesn’t scale well in large networks, according to Adam Conway, vice president of product management for Aerohive in Santa Clara, Calif. WPA PSK is also used extensively for branch or remote offices because it doesn’t depend on a remote RADIUS server, which could be disrupted if the WAN link is broken.
Furthermore, the WPA PSK is a single and irrevocable key, shared by every wireless client device on the WLAN (technically, all devices associating with a given SSID). That means all the access points and associated clients of that SSID share the same key, creating a widely known secret. If the key is compromised in any way, or an employee quits or is fired, every client has to be given a new key, a big administrative chore.
But the new Aerohive system, based on a patent-pending algorithm, bypasses these potential vulnerabilities, according to Conway. With Private PSK, the Aerohive wireless LAN now generates a unique key for each scanner or phone or guest user on a given SSID. And each key or password can be a long, complex string of characters, making them harder to break. Each key can be revoked separately if needed. In addition, each user or group of users now can be assigned specific security policies.
Aerohive offers two ways to generate and deploy the pre-shared keys.
For enterprise users, AreoHive’s HiveManager network management application identifies a list of unsecured clients, generates a key (essentially a complex password) for each, and e-mails the key to each user. At the same time, HiveManager deploys copies of the key/user database to each access point, which can keep track of up to 1,000 users. The user connects to an access point, enters the password, and is authenticated. All the clients can be on the same SSID, and each one has a unique key.
Alternatively, for guests, the keys can be created ahead of time, using AreoHive’s GuestManager application. GuestManager and the access points use a different algorithm than HiveManager to generate the keys. When a visitor checks in, the receptionist can hand over a printout with the unique password to enter when connecting to an access point. The actual authentication is handled by GuestManager’s integrated RADIUS server. The keys can be assigned a specific time limit, after which they’re not longer valid.
The Private PSK framework is available now, incorporated in HiveOS 3.3, HiveManager 3.3, and GuestManager 1.1 software. There is no additional charge.
Network World tested Aerohive’s “controller-less” WLAN architecture in October 2008. In February, Aerohive introduced changes in its access points that let the Hive WLAN schedule wireless traffic to optimize throughput, especially for networks with clients that are using different 802.11 flavors such as 11g and 11n.
