Aerohive upgrade streamlines WLAN security

Aerohive Networks has introduced for its wireless LAN products a pre-shared encryption key that it says is more secure and easier to administer than the option in enterprise Wi-Fi Protected Access 2 (WPA2), the widely used industry specification for WLAN security.

The new Private Pre-Shared Key (Private PSK) system creates and manages encryption keys for a range of Wi-Fi clients, such as phones and barcode scanners and similar mobile devices that can’t support the IEEE 802.1x authentication infrastructure, including Extensible Authentication Protocol (EAP), stipulated in WPA2. No new client-based code is needed. Private PSK can also be used to quickly secure access for visitors and guest users on the corporate LAN.

It’s very similar to the Dynamic PSK technology introduced in 2008 by Ruckus Wireless to solve the same problem: creating improved enterprise-grade security where reliance on the full panoply of public key infrastructure and RADIUS servers isn’t possible or feasible.

Devin Akin, co-founder and CTO of CWNP, an Atlanta-based company that offers a WLAN certification for IT professionals, is a fan of both the Ruckus and Aerohive innovations. In a recent blog post, he rhapsodized over the simplicity of new Aerohive Private PSK. “If you want to make a personal login for your friend Mark Elliott, then you create a user for him within the manual PPSK feature, assign Mark to a group, generate (or manually enter) a PSK [passphrase], and voila – you’re done,” he writes. “You want to revoke a user because he left the company? No problem…one click. I think I’m in love.”

Like the Ruckus offering, Areohive’s Private PSK system is an alternative to Wi-Fi Protected Access Pre-Shared Key. WPA is the Wi-Fi Alliance specification for improved WLAN security, with WPA2 Enterprise mandating the use of 802.1x, AES, and the other elements of the IEEE 802.11i specification. (An Alliance white paper on enterprise WPA/WPA2 deployments is available for download here.) 

The WPA Pre-Shared Key, in effect a user password, is intended for relatively small WLAN deployments, and doesn’t scale well in large networks, according to Adam Conway, vice president of product management for Aerohive in Santa Clara, Calif. WPA PSK is also used extensively for branch or remote offices because it doesn’t depend on a remote RADIUS server, which could be disrupted if the WAN link is broken. 

Furthermore, the WPA PSK is a single and irrevocable key, shared by every wireless client device on the WLAN (technically, all devices associating with a given SSID). That means all the access points and associated clients of that SSID share the same key, creating a widely known secret. If the key is compromised in any way, or an employee quits or is fired, every client has to be given a new key, a big administrative chore.

But the new Aerohive system, based on a patent-pending algorithm, bypasses these potential vulnerabilities, according to Conway. With Private PSK, the Aerohive wireless LAN now generates a unique key for each scanner or phone or guest user on a given SSID. And each key or password can be a long, complex string of characters, making them harder to break. Each key can be revoked separately if needed. In addition, each user or group of users now can be assigned specific security policies.