Motivation
Wireless networks based on the IEEE 802.11 standard require
lengthy layer two configuration parameters to be set
SSID (Network Name)
WEP Encryption Keys
802.1 Management and Internetworking
Network
802.2 Logical link control (LLC)
Embedded devices with
limited input capabilities are
unable to join the wireless
network until properly
configured
802.3
CSMA/CD
802.11
802.3
MAC
802.3
PHY
Data Link
802.11 MAC
802.11
FHSS
PHY
802.11
DSSS
PHY
802 Family
802.11a
OFDM
PHY
802.11b
HR/DSSS
PHY
Physical
OSI Model
Traditional layer three configurations protocols like DHCP
can be utilized once data layer communication is established
University of Kansas
802.11 Encapsulation
• 802.11 headers are unencrypted
• Access Points copy MAC addresses during the bridging
process
• Data portion encrypted
– No use to a station without keys
• Source address - 6 octets of data
• Broadcast
Ethernet
Destination
MAC
Source
MAC
TYPE
DATA
SNAP Header
Frame
Control
Duration/
ID
Addr 1
Addr 2
Addr 3
802.11 Header
University of Kansas
Seq
Addr 4
0xAA 0xAA
0x03
RFC 1042
encapsulation
0x00-00-00
802.11 Data
TYPE
DATA
FCS
Wi-Fi-Co Protocol
The Configurator host sends
wireless network parameters
to an embedded device via
broadcast packets
Wi-Fi-Co Configurator
Wi-Fi-Co Host
802.11 Wi-Fi
Wired Ethernet
PDA or Embedded Device
Workstation
Wi-Fi-Co Configuration Buffer
Header
SSID
MAC Source Address
I
I
I
SEQ
Const. Identifer
MAC Destination Address
Default
Key
WEP KEY(s)
ff
ff
ff
D
D
Data
ff
ff
ff
Integrity
Check
Configuration data
is embedded in the
source MAC address
Broadcast
Frame
Duration
Control
Addr 1
Addr 2
AP
Addr 3
A Wi-Fi station is able to
capture the configuration
frames and assemble the
data from the cleartext
802.11 headers
Seq
Addr 4
WEP IV DATA
FCS
802.11 MAC Header
Cleartext
University of Kansas
Encrypted Cleartext
Wi-Fi-Co Timing Diagram
•
•
•
Configurator constantly
broadcasts configuration
data in fragmented packets
The target assembles
configuration data and
decodes link level
parameters
Must “hop” Wi-Fi
channels to guarantee that
configuration data will be
received
University of Kansas
Configurator
Target
Configuration Message 1
0.0
Wi-Fi-Co: Frag
1
Wi-Fi-Co: Frag
2
Wi-Fi-Co: Frag
3
Wi-Fi-Co: Frag
4
Wi-Fi-Co: Frag
5
Wi-Fi-Co: Frag
N
1.21105
Wi-Fi-Co: Frag
1
1.23111
Wi-Fi-Co: Frag
1.25204
2
Wi-Fi-Co: Frag
3
1.28915
Wi-Fi-Co: Frag
4
1.31710
Wi-Fi-Co: Frag
5
Wi-Fi-Co: Frag
N
Wi-Fi-Co: Frag
1
0.05105
0.05710
0.09105
0.11105
0.68905
Configuration Message 2
2.41241
Configuration Message M
2.43141
2.45870
2.46014
guration
o ack of confi
TCP: Wi-Fi-C
Wi-Fi-Co: Frag
2
Target Configuration
Complete
Socket connection back to
Configurator
Protecting WEP Keys
•
Broadcast packets easily intercepted
• On wired Ethernet network portion
• On wireless network portion
•
Configuration data Encrypted
• Shared key symmetric cipher
• Embedded devices ship with
unique, pre-programmed key
• Certificate with product code
• Additional input required on
the Configuration host where it
is much easier than input to
embedded device
University of Kansas
Applications
University of Kansas