
WiN5200 Product Description | 19
EntertheEAP‐TLTSauthenticationmethod.Thistechniqueallowsboththesubscriberand
thebasestationtoauthenticateeachotherusinganX.509methodforboth,inadditiontoa
subscriberauthenticationwhichisbasedonwell‐knownsubscriberauthenticationtechniques
suchPAPandMS‐CHAP.MACcontrolheadersareneverencryptedinWiMAX,however
withEAPcarrierscanchoosetoauthenticatethem(buttheydonʹtnecessarilyhaveto).This
capabilityaddsanadditionallayerofauthenticationconfirmation.Itʹsanoperatorspecific
guidelinedecisionandistunableintheWin‐Max™system.
2.4.2.3 Encryption
ClearlythefirstlayerofdefenseforWiMAXoperatorsistoauthenticatealegitimateuseron
itsnetwork.However,WiMAX,withits802.16eratification,offerstoplinetoolsfor
encryptionofdata.Olderwirelessiterationsusedthedataencryptionstandard(DES)which
reliedona56‐bitkeyforencryption.Thisislargelyconsideredobsolete.WiMAX802.16e
certainlysupportsDES(3DES)butitalsoaddssupportfortheAdvancedEncryption
Standard(AES)whichsupports,128‐bit,192‐bitor256‐bitencryptionkeys.AlsoAESmeets
theFederalInformationProcessingStandard(FIPS)140‐2specification,requiredby
numerousgovernmentalbranches.Thistechnology,whichrequiresdedicatedprocessorson
boardbasestations,isrobustandhighlyeffective.
Trafficencryptionmaybeemployedper802.16ServiceFlowandissubjecttooperatorpolicy.
Therelevanceofencryptiontothenetworkoperatordeploymentisquestionable.Inthepast,
forexample,manycellularcarriersfocusedonauthenticationandmostlyignoredencryption.
Whetherthatwillchangeasmobileserviceprovidersrampupmorebroadbandapplications
isanopenquestion.
Thedownsidetotheseheavycomputingtasks(i.e.authenticationandencryption)isthatall
ofthisrequiresprocessorcycles,whichmayaffecttheperformanceofthesystem.
Nevertheless,theWin‐Max™systemandespecially,theSSandBST,whicharetheentities
thattakeactiveroleinheavysecurity‐relatedcomputations,werebuiltbottomtotopwitha
designgoalofoffloadingheavilycomputingtasksfromthehostprocessortoaspecificcircuit.
Consequently,noperformancedegradationisneglected.
2.4.2.4 Third Party Intrusion Protection
WeexaminedWiMAXauthenticationschemes,whichareamajorcomponentofasecure
network.Andwealsospokeofdataencryption.Clearly,WiMAXpossessessolidtools
alreadybuiltin.Butthereareconsiderationsbeyondjustgoodsecuritythatcandrivea
migrationtothirdpartyintrusiondetectionandprotectiontools‐‐‐namelybusinesscase
elements.Intrusionprotectionishowever,notdataprotection.Thesearetwodifferentclasses
ofsolution.Certainly,agoodthirdpartyintrusionprotectioncanmonitorandsecurea
networkʹsauthentication.However,manysolutionsalsoofferwormprotection,Trojanhorse