About Authentication, Security, Multiple users and a small change to Hayai's "Roaming WiFi"

[mgcarley]

I spent a large part of last-night and most of this morning pondering over various aspects of the network. As always, I'm trying to find flaws and make recalculations as often as possible so that we don't get caught out.

Because of India's Geography, we are dividing each "circle" as defined by the TRAI in to separate class-A networks. We still don't count traffic between any Hayai customers, but for reasons of topology, it matters.

While we could theoretically just run 1 big Class-A network over the entirety of India and subnetting as necessary, that would essentially limit us to about 16.7 million customers and then we have problems like the ones MTNL/BSNL/Airtel etc do whereby users on a particular IP range can't access a given website.

Now, basically each router is given an internal IP of 10.x.x.x (these private IPs matter only for management of the router by us), and that IP address is determined by your account number through a fairly simple algorithm I decided upon last night.

Customer IDs are made up of the circles 3-digit code then basically numerical order (skipping factors of 255 and 256) so customer ID BOM123456 is not the same as DEL123456, but they would have the same internal IP address on their respective networks, in this case 10.1.226.64 (knowing the IP address of the router is pretty useless for reasons I'll go in to later).

What was giving me problems was how we had planned to implement the Roaming-WiFi (going to a friend's house and using your credentials to log in to Hayai via WiFi). Previously, it was to be such that WiFi users would sign in for a WiFi session via PPPoE or a website, but then I thought: what about users who want to use it at home?

Normally this wouldn't be a problem, but then essentially we would have to allow multiple PPPoE sessions per login ID, but this would not be ideal for us.

Likewise, disallowing multiple PPPoE sessions per login ID would not be good for users who would go and use the service, because then they would have to ensure that the router was switched off at home (because the router would be logged in to PPPoE).

We couldn't use a dialer because those with multiple internet-ready devices (such as Xbox Live, PS3 or even more than 1 computer) would be out-of-luck unless you were to use Internet Connection Sharing or a separate broadband router. But these scenarios I think are less than ideal.

In addition, we couldn't just leave the WiFi open for anyone to see because that's a security risk as well as a huge legal problem (we're supposed to know everyone that uses WiFi), but more importantly, EVEN IF one logged in to WiFi at home, they would still have to log in separately to the other network. Which brings us back to the multiple PPPoE sessions problem.

So after much pacing around the room, I decided on the following solution to the conundrum:

[*]PPPoE will be taken care of by the router. Although it has a management address of 10.x.x.x, that address is not accessible by other customers - it will be assigned either a dynamic or static IP address depending on the plan.
[*]The device has a firewall and full NAT, so your local LAN IP's will be something like 192.168.1.x.
[*]WiFi will be protected by a WPA2-PSK key assigned by Hayai, and will simply be a part of the LAN, so WiFi is now in the control of the customer and you can simply connect any device via Ethernet or WiFi and assuming your computer is set up to get an address via DHCP, the internet will "just work".
[*]Roaming WiFi will be a separate service, and made available in public places. Hayai customers can purchase any number of hours per month on top of their existing plan, so for example, a customer with 5mbit/s unlimited for 2757 inc taxes could purchase 15 non-consecutive hours of WiFi for Rs 217 including taxes, or 90 hours for about Rs1000. **I am still trying to figure out if we could offer a certain number of hours per month to be included in the package.
[/list]
For the PPPoE WiFi, you can use any dialer in any operating system to connect: no special dialers are required. Just choose your 802.11b/g/n card as the connecting device and you're away.

PPPoE authentication is customerid@auth.hayai.co.in (eg BOM123456@auth.hayai.co.in)
WiFi authentication is customerid@wifi.hayai.co.in (eg BOM123456@wifi.hayai.co.in)

The SSID of the router will be Hayai-CUSTID, for example Hayai-BOM123456.

I thought this might pose a privacy concern, but then I decided that due diligence should be practiced on our part, so when you phone us, there is a keyword (which you decide) and 2 or more security questions (which you decide) that will be asked to validate you in addition to your Customer ID.

Also,as previously mentioned, the 128-bit 26-character WPA2-PSK is generated by us, as is the password for your account (10+ characters; lower, upper, numerals and punctuation).

To the internet, you will look like x.x.x.x.CITY.HAYAI.IN (so if you're in Mumbai, you'd be 210-210-210-210.bom.hayai.in, or if you're in Delhi you might be 211-211-211-211.del.hayai.in). This IP address (as mentioned) would be assigned to our CPE, not directly to your PC.

When we introduce IPTV and VOIP services, the CPE will get IP addresses as appropriate on those WAN interfaces but I think they're largely irrelevent anyway, since we just login to the router and update the configuration without you doing anything.

The router get's 1 IP address for each WAN type you subscribe to (it supports up to 8 separate WANs). For most at the moment, this would be just the 1 address.

And I think that's it so far. If anyone has any concerns, spots anything wrong or questions, as always be sure to let me know.

 

[anupcshan]

Suggestion :
How about having each wireless router run 2 WLANs - 1 private WLAN (for the fixed Hayai user) and 1 public WLAN (for the roaming user). Private WLAN will have the naming scheme mentioned above [The SSID of the router will be Hayai-CUSTID, for example Hayai-BOM123456.]

Public WLAN will have a common name, say 'Hayai WIFI' or something like that, and it will be open (unsecured). Public WLAN will work like a hotspot - web based login. [Assumption - people using their connection outside home may be more interested in browsing and chatting rather than torrents/downloading, and hence will be fine with logging in on a web interface one time per session.] Also, public WLAN will be run in the Architecture mode, so that the user can continue using this connection across multiple routers seamlessly - e.g, while traveling in a bus.

In short, use the wireless routers to build a sort of WiMax system around the city.
I really don't know if any of the above is feasible. But then, a 'cheap' WiMax system in town would be really nice to have 🙂

 

[elepton]

Why do you want 2 networks through a single line to each node? Why don't you use DHCP to assign a public IP to every customer, and use it for all the services like Internet, management, VoIP and IPTV?

From what I understood, you are using the same technology most ISPs use for consumer connections in India -- PPPoE inside an ATM VC to the ISP switch, and that your CPE supports 8 ATM VCs. This is very old and has a lot of overhead (http://www.oplink.net/files/WhitePaper_EncapsOverheads.pdf). Why don't you use direct ethernet without any encapsulation to the CPE?

 

[mgcarley]

Suggestion :
How about having each wireless router run 2 WLANs - 1 private WLAN (for the fixed Hayai user) and 1 public WLAN (for the roaming user). Private WLAN will have the naming scheme mentioned above [The SSID of the router will be Hayai-CUSTID, for example Hayai-BOM123456.]


Someone may have some interesting firmware for a particular model, but I don't think any Wireless routers have this capacity that I know of.

While it can connect to many different WANs (eg Data, IPTV, SIP etc) and has MAC address filtering on the device itself, I don't think it can distinguish one WiFi client from another, that is, if we wanted to do any kind of authentication via MAC, we'd have to get everyone's WiFi MAC addresses and put that on record, but I think it might make things unnecessarily complicated.

Included in a future firmware update there is something to do with guest access, though. I shall ask them about it when I visit the company.

Public WLAN will have a common name, say 'Hayai WIFI' or something like that, and it will be open (unsecured). Public WLAN will work like a hotspot - web based login. [Assumption - people using their connection outside home may be more interested in browsing and chatting rather than torrents/downloading, and hence will be fine with logging in on a web interface one time per session.] Also, public WLAN will be run in the Architecture mode, so that the user can continue using this connection across multiple routers seamlessly - e.g, while traveling in a bus.

In short, use the wireless routers to build a sort of WiMax system around the city.
I really don't know if any of the above is feasible. But then, a 'cheap' WiMax system in town would be really nice to have 🙂

Not really, but we do have a separate WiMax service coming up already for your latter suggestion.

What we *could* do is get routers like FON has, which would mean that some users might have 2 WiFi routers, and we could get that to authenticate separately, because it would be plugged in to a particular ethernet port and we can direct all of that traffic through our authentication mechanism (whether PPPoE over WiFi or a web-based login).

I assume we would have to "reward" users who took on the separate router, but at the same time we might have to be picky about where it went. The point would still be that it would only be for Hayai customers.

But, then still there is the issue of using the connection in multiple places and allowing that at our end.

Why do you want 2 networks through a single line to each node? Why don't you use DHCP to assign a public IP to every customer, and use it for all the services like Internet, management, VoIP and IPTV?


*Public* IP addresses are already done via DHCP, but IPTV and VoIP are separate services. IPTV would be delivered through a different part of our internal network, not the public internet.

From what I understood, you are using the same technology most ISPs use for consumer connections in India -- PPPoE inside an ATM VC to the ISP switch, and that your CPE supports 8 ATM VCs. This is very old and has a lot of overhead (http://www.oplink.net/files/WhitePaper_EncapsOverheads.pdf). Why don't you use direct ethernet without any encapsulation to the CPE?

That would essentially be PPPoA you're referring to, which applies to DSL. Strictly speaking, this *is* ethernet... just... fast and using fiber-optics.

The router gets the management IP address (the 10.x.x.x address) with IPoE via DHCP, but that address is statically assigned to whatever port you're customer ID is plugged in to at our end, then once the PPPoE session is established by the router, it gets the public IP address.

On the other hand, Authentication via MAC address has it's own problems. Anyone on a cable provider will know what I'm talking about.

Part of the reason we even have to do authentication is one of those stupid laws your government came up with a few years ago. In short, it would not be legal for us to use direct ethernet without any kind of encapsulation.

Ever wonder why there are so few internet cafes in India, but a million and twelve in places like Singapore, Hong Kong, Malaysia etc, or why you have to submit every single detail of your life just to get a SIM card, whereas in most of Europe I can just pay the 5EUR and walk out of the store without showing any ID?

 

[Topweb]

The SSID of the router will be Hayai-CUSTID, for example Hayai-BOM123456.

I thought this might pose a privacy concern, but then I decided that due diligence should be practiced on our part, so when you phone us, there is a keyword (which you decide) and 2 or more security questions (which you decide) that will be asked to validate you in addition to your Customer ID.

Also,as previously mentioned, the 128-bit 26-character WPA2-PSK is generated by us, as is the password for your account (10+ characters; lower, upper, numerals and punctuation).

This is a very bad idea. A customer should be allowed to select WPA2-PSK key for his router. What if my WPA2-PSK key is leaked by one of your disgruntled employee and misused for anti-social activity or by some terrorist. I am the one who will be dragged through a legal nightmare.

Do you remember the case of an American citizen whose WPA key was used by a Tata/VSNL employee in Mumbai to send an email claiming responsibility of a bomb blast that killed several people?

If WPA2-PSK key is to be generated by you then I'll rather choose to switch off the wireless capability of the CPE.

---------- Post added at 07:44 PM ---------- Previous post was at 07:35 PM ----------

Further login and password are two things that one needs to login into anything. When you are broadcasting my customer ID as SSID, then you are giving away 50% of that info for free to anyone who is interested in misuse of that info. This idea also doesn't make sense to me.

 

[mgcarley]

This is a very bad idea. A customer should be allowed to select WPA2-PSK key for his router. What if my WPA2-PSK key is leaked by one of your disgruntled employee and misused for anti-social activity or by some terrorist. I am the one who will be dragged through a legal nightmare.


In theory, I should be the only one who knows the algorithm by which the WPA key is generated. Besides, we would hope that we treat our employees well enough that they do not become disgruntled.

Do you remember the case of an American citizen whose WPA key was used by a Tata/VSNL employee in Mumbai to send an email claiming responsibility of a bomb blast that killed several people?


No. But interesting. In theory the Tata/VSNL employee shouldn't have known that though. Was it sniffed?

If WPA2-PSK key is to be generated by you then I'll rather choose to switch off the wireless capability of the CPE.

If this is a concern, then I think you might be right. The thing is, though, nowhere else have I seen such paranoia towards WiFi.

 

---

[Sushubh]

well our ISPs are so awesome that they have provided in the past wrong information about IP addresses to the government. which resulted in wrong person getting blamed for some threat calls made to the G family. that guy landed in jail for a couple of months before airtel realized their mistake. it took weeks before the system functioned and that person was released. 🙂

 

[mgcarley]

Further login and password are two things that one needs to login into anything. When you are broadcasting my customer ID as SSID, then you are giving away 50% of that info for free to anyone who is interested in misuse of that info. This idea also doesn't make sense to me.

Yes and no. Even with that information, only another Hayai customer could even get on to our network because they'd need our fiber to connect.

Since it is IP + username and password, there is an additional layer of physical security: they would also need to be connected to the correct port, otherwise the device would get the wrong management IP address... so even if BOM123456 tries to connect from an IP assigned to a port that's valid for BOM654321, the device *should* fail to connect.

 

[Topweb]

In theory, I should be the only one who knows the algorithm by which the WPA key is generated. Besides, we would hope that we treat our employees well enough that they do not become disgruntled.

You never know when an Apple turns out to be bad.


No. But interesting. In theory the Tata/VSNL employee shouldn't have known that though. Was it sniffed?


The Tata/VSNL guy was a service technician who went to the apartment of an American expat in Navi Mumbai to fix problem in connection. The customer himself told him what the key was. Few days later, this Tata/VSNL guy logged on the net while standing outside the apartment building and sent an email claiming the responsibility of the bomb blast. The apartment under question was turned upside down by the police and the American guy was detained for investigation and a ban imposed on him as well as his family leaving the country. When released on bail, he ran away from India. This Tata/VSNL technician was widely reported on TV news at that time.

American says his computer was hacked - dnaindia.com

Kenneth Haywood slips out of country from Delhi airport - dnaindia.com

If this is a concern, then I think you might be right. The thing is, though, nowhere else have I seen such paranoia towards WiFi.

This is because wi-fi connections have been used by terrorists as well as anti-social elements repeatedly in the last few years and innocent customers are left to face the music.

 

[Sushubh]

and most people are not smart enough to make their own connections secure. government does not listen to excuses anymore. the best solution is that the ISP ensures that the wireless connectivity at their customer's premises are secure and the user knows of the consequences. the first thing i asked my neighbor uncle when he called me up to fix some problems he was facing on his laptop was whether his wireless network is secured with a password or not. thankfully he had heard of the stories above and told me that he uses a password and does not reveal it to anyone. 😀

 

[mgcarley]

You never know when an Apple turns out to be bad.

True. But like I said, I should be the only one knowing the Algorithm OR we should take up your suggestion of ensuring customers set a secure key. As it happens, the device also has a special one-touch WiFi setup button - you have to enter a pin code which is unique to the router or something.

This is because wi-fi connections have been used by terrorists as well as anti-social elements repeatedly in the last few years and innocent customers are left to face the music.

****ing terrorists. I don't care about their causes and stuff, I care that they cause me inconveniences. Same goes for anything else actually 😉

---------- Post added at 08:19 PM ---------- Previous post was at 08:18 PM ----------

and most people are not smart enough to make their own connections secure. government does not listen to excuses anymore. the best solution is that the ISP ensures that the wireless connectivity at their customer's premises are secure and the user knows of the consequences.

the first thing i asked my neighbor uncle when he called me up to fix some problems he was facing on his laptop was whether his wireless network is secured with a password or not. thankfully he had heard of the stories above and told me that he uses a password and does not reveal it to anyone. 😀

The device automatically enables security with the aforementioned one-touch button.

----------------------------------------------

---------- Post added at 08:30 PM ---------- Previous post was at 08:19 PM ----------

What is WPS? *
Wi-Fi*Protected*Setup*(WPS)*is*a*standard*created*by*the*Wi-Fi*Alliance*for*easy*and*secure*establishment*of*a*wireless*home/office*network.*

The*goal*of*the*WPS*protocol*is*to*simplify*the*process*for*configuring*the*security*of*the*wireless*network,*and*thus*calling*the*name*Wi-Fi*Protected*Setup. There*are*several*different*methods*defined*in*WPS*to*simplify*the*process*of*configuration.*

FSG2200HNU*supports*two*of*those*methods,*which*are*the*PIN* Method*and*the*PBC*Method.

PIN*Method:*
A*PIN*(Personal*Identification*Number)*has*to*be*read*from*either*a*sticker*on*the*new*wireless*client*device*or*a*display,*and*entered*at*either*the*wireless*access point*(AP)*or*a*Registrar*of*the*network.

PBC*Method:*
A*simple*action*of*“push*button”*suffices*the*process*to*activate*the*security*of*the wireless*network*and*at*the*same*time*be*subscribed*in*it.*

---------- Post added at 08:31 PM ---------- Previous post was at 08:30 PM ----------

Grrr, even running through notepad seems to not clear this ** issue up 🙁

 

[ziff]

--Software not relevent to discussion--

 

[mgcarley]

May have figured this WiFi issue out. Those who have been following me on Twitter have probably noticed some fairly at-length discussions about 802.1x. Potentially this means that we could theoretically use simple port-binding (with a username and password for the extra security), but this would allow us to:1. Ensure that only 1 user is connected to the user account at any given time and2. Allow us to use the same mechanism whether you connect via Wired, WiFi or any other connection. This means that you could go to your friends house or a coffee shop and connect to that WiFi (assuming it's one of our access points) and have the usage charged to your account only. If you've only got a single machine connecting to our service, the ability to roam would be great (and you would not have to pay extra for it)!3. This means that we can potentially make CPEs completely optional. Default would be a media-converter, and CPEs only come in to question when you subscribe to IPTV and/or VOIP services.

 

[wolvi]

This means that we can potentially make CPEs completely optional. Default would be a media-converter, and CPEs only come in to question when you subscribe to IPTV and/or VOIP services.

In that case the "CPE issue" could have been avoided and the rollout would not have been delayed.....at least broadband rollout could have been earlier with readily available media converters...IPTV,VOIP was anyways planned for launch at a later date in the original scheme of things if i am not mistaken

 

[mgcarley]

In that case the "CPE issue" could have been avoided and the rollout would not have been delayed.....at least broadband rollout could have been earlier with readily available media converters...IPTV,VOIP was anyways planned for launch at a later date in the original scheme of things if i am not mistaken

It could have been avoided, yes, and it was a huge mistake on our part. I wanted the devices to support everything from the get-go. More effective (and would have been cheaper) for us to get devices that do what we want than having to replace them after only 6-9 months, and way more effective than having 2, 3 even 4 devices to sort out the various services (in my parents house in NZ they have 3 devices to supply Broadband and VOIP only!)

Surprisingly, consumer triple-play GigE capable FTTH equipment isn't as easy to come by as you might expect - most of it only supports 100-base FX/BX or worse, FTTB with triple play services delivered from the basement to the home (in other words, the last 20-50 meters) over... VDSL!!

Now the cost of direct-fiber devices are almost down to a similar pricing level to the VDSL gear (a VDSL DSLAM for an apartment block costs about US$100 per line, but averaged over say 5 years it's only a couple of dollars a month) so VDSL basically no longer makes sense - only thing is, VDSL gear is more widely available, and we may still have to deploy it in buildings that won't let us run our own cables.

Funny what 6-months can do.