WO2010108513A1

WO2010108513A1 - Wireless-network interface with split architecture

Info

Publication number: WO2010108513A1
Application number: PCT/EP2009/002207
Authority: WO
Inventors: André RICKARDSSON
Original assignee: Bitsec Ab
Priority date: 2009-03-26
Filing date: 2009-03-26
Publication date: 2010-09-30
Also published as: SE1150995A1

Abstract

A wireless-network interface device, WNID (20), is provided for establishing a wireless connection (16) between a host computing device (10) and at least one other computing device. The WNID comprises first circuitry (21) for handling the communication with the host computing device, second circuitry (22) separate from the first circuitry and being arranged for handling the communication over the wireless connection, and a secure communication link (23) for connecting the first circuitry and the second circuitry. Data communicated by the host computing device over the wireless connection is transferred between the first circuitry and the second circuitry exclusively through the secure communication link. The WNID according to the present invention is advantageous in that it provides an improved intrusion protection by employing a split architecture separating the kernel (12) of the host operating system (11) from the parts of the WNID that handle the communication over the wireless connection.

Description

WIRELESS-NETWORK INTERFACE WITH SPLIT ARCHITECTURE

Field of the invention

The invention relates to wireless-network interface devices that can be used for establishing a wireless connection between two computing devices, e.g., a computer connecting to an access point of a wireless local area network (WLAN).

Background of the invention

The use of wireless local area networks to connect a computer to a corporate network or to the internet has become increasingly popular during the past years. Besides WLAN there are other techniques for establishing a wireless connection between two computing devices. A computer that is provided with a modem may, e.g., establish a wireless connection with a mobile phone network such as GSM/GPRS, UMTS, or LTE. Bluetooth is a wireless technique that is frequently used to connect devices like mobile phones and computer accessories, such as keyboards and printers, to a computer. Further, WiMAX is a technique that is aimed at wireless broadband access.

An inherent problem of wireless networks is that they are more vulnerable to intrusion by an attacker than non-wireless networks. One reason for this increased vulnerability is that physical access can be gained more easily, since coverage of a network might extend beyond an otherwise restricted area. Another reason is that the first and second layer of the seven- layer OSI model are exposed in the wireless communication, and that these layers are more vulnerable than the higher layers.

Certain types of attacks, such as buffer overflow and kernel exploit, are aimed at the operating system of a computer taking part in a wireless communication and can compromise the integrity of the computer. Securing a driver for a wireless-network interface device against all known types of attacks is a tedious task. Furthermore, the device vendor is urged to continually update drivers for existing network interfaces devices as new types of attacks emerge.

Summary of the invention It is an object of the present invention to overcome these problems and to provide a wireless-network interface device that has an improved intrusion protection.

This is achieved by means of a wireless-network interface device having the features defined in independent claim 1. Embodiments of the invention are characterized by the dependent claims.

Hence, according to an aspect of the present invention, a wireless- network interface device for establishing a wireless connection between a host computing device and at least one other computing device is provided. The wireless-network interface device comprises first circuitry, second circuitry, and a secure communication link. The first circuitry is arranged for handling the communication with the host computing device. The second circuitry is separate from said first circuitry and is arranged for handling the communication over the wireless connection. The secure communication link is arranged for connecting the first circuitry and the second circuitry. Data communicated by the host computing device over the wireless connection is transferred between the first circuitry and the second circuitry exclusively through the secure communication link. A computing device can be any device that is capable of establishing a connection with another computing device for the purpose of data transfer, e.g., a computer, computer accessories, a network printer, a network disk, a wireless access point of a WLAN, a mobile phone, or a PDA.

The present invention is based on the realization that the kernel of the host operating system can be protected from attacks over a wireless connection by employing a split architecture for the wireless-network interface device that separates the kernel and the driver of the host operating system from the parts of the wireless-network interface device that handle the communication over the wireless connection. To this end, the kernel of the host operating system only communicates with the first circuitry. The communication between the host and the first circuitry is similar to that between a host and a conventional network interface device, and is performed through a driver run by the host kernel. The circuitry controlled by the driver is, however, not handling the wireless communication but only the communication with the second circuitry through the secure communication link. The communication over the secure link is effected using a protocol less vulnerable to attacks than the wireless protocols used for the communication over the wireless connection. The present invention is advantageous in that the effects of an attack exploiting possible weaknesses of the wireless protocol used for communicating over the wireless connection cannot propagate into the kernel of the host operating system. The fact that the wireless communication is exclusively handled by the second circuitry, and that data communicated over the wireless connection is received from or transmitted to the host kernel exclusively through the secure communication link and the first circuitry, renders the kernel less vulnerable to attacks. In other words, the effects of an attack are confined to the second circuitry, and the security of the host is therefore not compromised. Thus, a wireless-network interface device is provided having an improved protection against attacks aimed at the operating system kernel of the computing device hosting the wireless-network interface device.

According to an embodiment of the invention, the communication through the secure link is effected using a non-wireless protocol. This is advantageous in that non-wireless protocols in general are less complex than wireless protocols, owing to the lesser number of parameters to possibly be manipulated, and are therefore more difficult to exploit for attacks.

According to another embodiment of the invention, the communication through the secure link is effected using the third or a higher layer of the seven-layer OSI model. This is advantageous in that the higher layers of the OSI model are less susceptible to attacks then the first and second layer. According to a further embodiment of the invention, the secure communication link is an Ethernet connection. In this case, the first circuitry is essentially a conventional Ethernet network interface device.

According to an embodiment of the invention, the second circuitry comprises processor means for handling the wireless communication, e.g., a processor executing appropriate software.

According to an embodiment of the invention, the encryption of data originating from the host and being destined for transmission over the wireless connection, and the decryption of data received over the wireless connection and being destined for the host, is performed by an additional cryptography module through which the data communicated over the secure link passes. The cryptography module is preferably implemented by circuitry separate from the first circuitry and the second circuitry.

According to another embodiment of the invention, the authentication of a connection between the host and another computing device is performed by an additional authentication module through which the data communicated over the secure link passes. The authentication module is preferably implemented by circuitry that is separate from the first circuitry and the second circuitry. An advantage of having separate circuitries and modules is that their functionality can be tested and certified separately.

According to an embodiment of the invention, the second circuitry is arranged for communication over more than one wireless connection. This is advantageous in that the host can communicate over several connections. The host can, e.g., communicate using different networking standards or radio technologies, or the host can be a node in more than one network. The second circuitry may be arranged to effect the distinct communications concurrently. As an alternative, the second circuitry may also be arranged to effect one communication at a time. For example, the second circuitry may be configured to establish a wireless connection, and communicate over that connection, following a predetermined set of rules, such as choosing the connection with greatest received signal strength or the highest transfer rate of the connection. According to an embodiment of the invention, the communication over the wireless connection is effected using any one or a combination of a plurality of wireless-networking techniques, including WLAN, Bluetooth, GSM, GPRS, UMTS, LTE, and WiMAX. According to an embodiment of the invention, the network interface device further comprises a one-way communication link for sending configuration data from the host to the second circuitry. The configuration data may, e.g., pertain to settings required for the wireless connection, or any other parameters that are needed to effect the wireless communication. Further objectives of, features of, and advantages with, the present invention will become apparent when studying the following detailed disclosure, the drawings and the appended claims. Those skilled in the art realize that different features of the present invention can be combined to create embodiments other than those described in the following.

Brief description of the drawings

The above features and advantages of the present invention will be better understood through the following illustrative and non-limiting detailed description of embodiments of the present invention, with reference to the appended drawings.

Fig. 1 shows the architecture of a host with a conventional wireless- network interface device.

Fig. 2 shows the architecture of a host with a wireless-network interface device according to an embodiment the invention. Fig. 3 shows a wireless-network interface device with an additional cryptography module.

Fig. 4 shows a wireless-network interface device for multiple wireless- networking technologies.

Fig. 5 shows a wireless-network interface device with an additional one-way communication link for sending configuration data.

All the figures are schematic, not necessarily to scale, and generally only show parts which are necessary in order to elucidate the invention, wherein other parts may be omitted or merely suggested. Detailed description of embodiments of the invention

Fig. 1 shows the architecture of a host computing device 10 provided with a conventional wireless-network interface device (WNID) 14. The host 10 can be any type of computing device that is equipped with a processor, on which an operating system 11 comprising a kernel 12 can be executed, e.g., a computer, computer accessories, a network printer, a network disk, a wireless access point of a WLAN, a mobile phone, or a PDA. The purpose of the WNID 14 is to enable the host 10 to establish a wireless connection 16 with at least one other computing device and to communicate over the wireless connection 16, i.e., to transmit data to another computing device or to receive data from another computing device. By establishing a wireless connection the host can become a node of a wireless network.

The wireless communication 16 can be effected by any of several radio based wireless-networking technologies and standards, such as WLAN (IEEE 802.11), Bluetooth (IEEE 802.15), GSM/GPRS/UMTS/LTE (3rd Generation Partnership Project, 3GPP), and WiMAX (IEEE 802.16). The WNID 14 is configured with a radio transceiver (not shown in Fig. 1) in order to effect the communication over the wireless connection 16.

As an example, the host 10 can be a portable computer that accesses a corporate network or the internet through an access point of a WLAN. As another example, a portable computer can communicate via Bluetooth with a mobile phone, which in turn communicates with the internet over a mobile phone network such as GSM/GPRS, UMTS, or LTE.

Frequently, portable computers are supplied with a built-in dedicated WLAN module, whereas stationary computers can be equipped with an extension card. A WNID may also be connected to a computer through an external input/output interface like USB, FireWire, or PCMCIA.

With reference to Fig. 1 , data originating from the host 10 and being destined for transmission over the wireless connection 16, as well as data received over the wireless connection 16 and being destined for the host 10, is communicated between the host 10 and the WNID 14 using a driver 13 executed by the kernel 12 of the host operating system 11. Malicious data received over the wireless connection 16, e.g., data that pertains to an attempted attack, can propagate through the driver 13 into the host kernel 12 where it can be executed and potentially cause a crash.

With reference to Fig. 2, a WNID 20 according to an embodiment of the invention is described. The WNID 20 is embodied by means of a split architecture that separates first circuitry 21 , which communicates with the kernel 12 of the host operating system 11 , from second circuitry 22, which handles the wireless communication 16. The communication between the two circuitries is effected over a secure communication link 23. Thus, the kernel 12 of the host operating system 11 communicates, by means of a driver 13', only with the first circuitry 21 of the WNID 20. Data communicated by the host 10 over the wireless connection 16 is transferred between the first circuitry 21 and the second circuitry 22 exclusively over the secure link 23. Data received by the WNID 20 over the wireless connection 16 is processed in the second circuitry 22 and transmitted to the first circuitry 21 over the secure link 23. Thus, malicious data received by the WNID 20 and being destined to exploit a potential weakness of the protocol used for the communication over the wireless connection 16, is not forwarded over the secure link 23 and does therefore not propagate to the kernel 12 of the host operating system 11. The communication over the secure link 23 can be effected using any protocol less vulnerable than the wireless protocol used for the wireless connection 16. Preferably, a standardized protocol is used.

According to an embodiment of the invention, the secure link 23 is an Ethernet connection, as described by the IEEE 802.3 standard. In this case standard Ethernet circuitry may be used for implementing the secure link 23 between the first circuitry 21 and the second circuitry 22. The first circuitry 21 is, in this case, essentially an Ethernet network interface device. Using a standardized technology for the secure link 23 is advantageous in that readily available off-the-shelf components can be used.

With reference to Fig. 2, the second circuitry 22 may comprise processor means for handling the communication over the wireless connection 16. The processor means can, e.g., be implemented by a processor (not shown in Fig. 2), an operating system 24 executed on the processor, and a driver 26 executed by the kernel 25 of the operating system 24 and which controls the second circuitry 22.

With reference to Fig. 3, an alternative embodiment of a WNID is described. The WNID 30 is similar to the WNID 20, which was described with reference to Fig. 2, and comprises a first circuitry 31 for handling the communication with the host, and a second circuitry 32 for handling the communication over the wireless connection 16. The secure link of the present embodiment, however, is arranged for encryption of data send by the host over a wireless connection (not shown in Fig. 3), and decryption of data received by the host over the wireless connection. The encryption and decryption can, e.g., be performed by arranging the secure link with a cryptography module 34 between the first circuitry 31 and the second circuitry 32, such that the secure link is divided into two separate parts 33' and 33". The cryptography module 34 can, e.g., be implemented by circuitry, a processor running an appropriate software, or a combination thereof.

Preferably, the cryptography module is a standard cryptography chip. The two secure links 33' and 33" can be implemented in the same way as described with reference to Fig. 2, e.g., as an Ethernet connection. In this case standard Ethernet circuitry can be used to interface with the cryptography module. As an alternative, the implementation of the secure links 33' and 33" can be adapted to match the input/output interfaces of the cryptography module 34. It will be appreciated that, although the introduction of a cryptography module 34 was described with reference to Fig. 3, other types of modules can be introduced instead. For instance, according to another embodiment of the invention, an authentication module may be introduced for the purpose of authenticating the connection between the host and another computing device that the host is communicating with.

In Fig. 4, another embodiment of the WNID is shown. The WNID 40 is arranged to establish multiple wireless connections 16'-16"-16'", over which the host can communicate. For instance, the wireless connections 16'-16"- 16'" can be established using different wireless-networking technologies such as WLAN, Bluetooth, GSM/GPRS, UMTS, LTE, or WiMAX. In this case the second circuitry 42 comprises multiple separate circuitries 45'-45"-45'", at least one circuitry for each type of networking technology that is required. For instance, 45' can be WLAN circuitry, 45" Bluetooth circuitry, and 45'" UMTS circuitry. The circuitries 45'-45"-45'" can also comprise other circuitry that is necessary to establish a wireless connection and to transmit and receive data according to the respective networking technology, e.g., a radio transmitter, a radio receiver, or a built-in antenna (not shown in Fig. 4). The circuitries may also share components and/or antennas.

The embodiment of the WNID 40 described with reference to Fig. 4 is advantageous in that the host can communicate over different types of wireless connections 16'-16"-16'". The WNID 40 can, e.g., be configured to choose one connection among the available connections 16'-16"-16'" according to a set of rules. For example, the WNID 40 can be configured to communicate over the connection that provides that highest transfer rate. As an alternative, the connection resulting in the lowest power consumption may be preferred.

The WNID 40 may also be arranged to communicate concurrently over multiple wireless connections 16'-16"-16'". This is advantageous in that the host can take part in multiple communications. For instance, the host may communicate with the internet over WLAN while at the same time synchronizing the address book of a PDA over Bluetooth.

With reference to Fig. 5, another embodiment of the invention is described. The WNID 50 comprises a one-way communication link 56 for sending configuration data from the first circuitry 51 to the second circuitry 52. The host 10 may, e.g., send settings regarding the wireless connection 16 to the second circuitry 52. The host 10 may also send a set of rules that can be used to determine which connection of a plurality of wireless connections should be used for communication, as was described with reference to Fig. 4. As another example, the host may send WEP/WPA keys that are needed for encrypting/decrypting a WLAN connection. Using a one-way link 56 is advantageous in that data only can be transmitted from the first circuitry 51 to the second circuitry 52, and not vice versa. Thus, no data can be send from the second circuitry 52 over the one-way link 56 to the first circuitry 51 in case of an attack. The data paths in WNID 50 are separated such that data communicated over the wireless connection 16 is transmitted over the secure link 53, while data pertaining to the configuration of the second circuitry 52 is sent over the one-way link 56. The one-way link 56 can, e.g., be implemented by an optical communication link having an optical transmitter at the first module 51 and an optical receiver at the second module 52.

The circuitries, modules, and links described above can be implemented by electronic components, integrated circuits (IC), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA), and/or complex programmable logic devices (CPLD), or any combination thereof. It will also be appreciated that any circuitry can, at least in part, be replaced by processing means, e.g., a processor executing an appropriate software.

The person skilled in the art realizes that the present invention by no means is limited to the embodiments described above. On the contrary, many modifications and variations are possible within the scope of the appended claims. For example, the WNID 40 described with reference to Fig. 4 may be arranged for communication over any number of connections other than the exemplified three. It will also be appreciated that, despite that fact that separate circuitries and modules are described above, any combination of circuitries and/or modules, as well as the links, can be implemented as integrated circuits. Thus, an embodiment of the invention may comprise any combination of standard components and components specifically designed for the application at hand, e.g., ASICs.

Claims

1. A network interface device (20, 30, 40, 50) for establishing a wireless connection (16, 16', 16", 16'") between a host computing device (10) and at least one other computing device, said network interface device comprising: first circuitry (21 , 31 , 41 , 51) being arranged for handling the communication with the host computing device, second circuitry (22, 32, 42, 52) separate from said first circuitry, said second circuitry being arranged for handling the communication over the wireless connection, and a secure communication link (23, 33'-33", 43, 53) being arranged for connecting said first circuitry and said second circuitry, wherein data communicated by the host computing device over the wireless connection is transferred between said first circuitry and said second circuitry exclusively through said secure communication link.

2. The network interface device according to claim 1, wherein the communication through said secure communication link is effected using a non-wireless protocol.

3. The network interface device according to claim 1 , wherein the communication through said secure communication link is effected using the third or a higher layer of the OSI model.

4. The network interface device according to claim 1 , wherein said secure communication link is an Ethernet connection.

5. The network interface device according to claim 1 , wherein said second circuitry comprises processor means (24, 25, 26) for handling the communication over the wireless connection.

6. The network interface device according to claim 1 , wherein said secure communication link comprises a third circuitry (34) separate from said first circuitry and said second circuitry, said third circuitry being arranged for encryption of data transmitted from said first circuitry to said second circuitry and for decryption of data transmitted from said second circuitry to said first circuitry.

7. The network interface device according to claim 1 , wherein said secure communication link further comprises a third circuitry (34) separate from said first circuitry and said second circuitry, said third circuitry being arranged for authentication of data communicated over the wireless connection.

8. The network interface device according to claim 1 , wherein said second circuitry is arranged for communication over a plurality of wireless connections (16', 16", 16'").

9. The network interface device according to claim 1 or 8, wherein said at least one wireless connection is established using any one or a combination of wireless-networking techniques, including WLAN, Bluetooth, GSM, GPRS, UMTS, LTE, and WiMAX.

10. The network interface device according to claim 1 , further comprising a one-way communication link (56) being arranged for sending configuration data from said first circuitry to said second circuitry.

11. A computing device comprising the network interface device according to any previous claim.