Wireless Access

last person joined: 8 hours ago 

Access network design for branch, remote, outdoor and campus locations with Aruba access points, and mobility controllers.
Expand all | Collapse all

Encryption keys in controller-based and controllerless networks

Jump to Best Answer
  • 1.  Encryption keys in controller-based and controllerless networks

    Posted Sep 29, 2018 04:28 PM

    Hi guys,

     

    Roughly, what is the difference about encryption key management between controller-based and controllerless networks? When I say controller-based solution I refer to tunnel mode. I understand in a controller-based solution in tunnel mode all the keys are managed and stored in the controller, whereas in a controllerless or Instant solution the keys are stored in each IAP, is that right? I have heard that for that reason, the controller-based solution is more secure than the Instant solution, is that right?

     

    Regards,

    Julián



  • 2.  RE: Encryption keys in controller-based and controllerless networks

    Posted Sep 29, 2018 04:55 PM

    I don't think that is the case (that it is necessarily more secure).  Since you cannot recover the configuration from an Instant AP, you cannot recover the keys.  Controller-based is more secure than other "fat" aps, where you can recover the configuration.



  • 3.  RE: Encryption keys in controller-based and controllerless networks

    Posted Sep 29, 2018 05:10 PM
    Hi Colin,

    I thought the same, that although the keys are distributed among all the IAPs in the cluster, they cannot be recovered. But I have heard that some organizations such as banks and government entities go more for controllers, because they like to have all the security keys centralized in one single appliance.

    Regards,
    Julián


  • 4.  RE: Encryption keys in controller-based and controllerless networks

    Posted Sep 29, 2018 05:19 PM

    Please let me know who you heard that from.



  • 5.  RE: Encryption keys in controller-based and controllerless networks
    Best Answer

    Posted Sep 30, 2018 01:21 PM

    You might have seen that in the Aruba Networks Government Solutions Guide, more specific Requirement 3:

     

    "In an Aruba (added: controller) network, sensitive information such as user encryption keys remains inside the data center in the Controller. In our opinion, AP-based crypto does not provide end-to-end encryption, as mandated by DoD Directive 8100.2 because encryption ends at the AP, not the core of the network. This mandate has forced some organizations to deploy “overlay cryptography” solutions to ensure FIPS, UC-APL and/or DoD Directives compliance, which in turn increase complexity, and causes significant design challenges and awkward end-device behavior."

     

    What I personally like in the centralized encryption is that because there is no user traffic crypto processing and thus the keys needed for that in the AP, you can consider the AP and all network between the AP and the controller out-of-scope for your security evaluation of the wireless. That means that you can place APs even in untrusted environments while keeping the wireless traffic itself secured. With encryption in the AP you probably can get to an acceptable security level on most deployments if you take the AP itself, and the port it is connected to, in-scope and evaluate the overall security. Instant APs can even run in FIPS mode to get validated crypto operations.

     

    There is some good reading in the article mentioned above.



  • 6.  RE: Encryption keys in controller-based and controllerless networks

    Posted Oct 01, 2018 10:47 AM

    Hi Herman,

     

    Indeed it makes a lot of sense. With a tunnel controller-based solution the security remains through the switched network up to the data center/core where the controller is. With the decrypt-tunnel mode or Instant solution the traffic travels unencrypted throught the switched network. I will have a look to that document. Many thanks.

     

    Regards,

    Julián