Ensuring Security in WiMAX Networks

1. Introduction

Security of wireless networks is a major concern as the developments of new wireless technologies have emerged over the years. As more and more wireless devices are added to the network, the wireless broadband security becomes more complicated. Since the wireless devices use the radio waves as a medium for transmission and reception, protection of the radio transmission is a concern for protocol designers. Hence, the public networks must be designed and implemented with reference to the latest security standards in order to protect confidential and personal information over the air interface.

WiMAX is an abbreviation for Worldwide Interoperability for Microwave Access. WiMAX is defined by the IEEE 802.16 standard. The IEEE 802.16 standard “defines the air interface for fixed point-to-multipoint broadband wireless access networks.” [1] In today’s world, IEEE 802.16e standard is popular and is used extensively. “It defines additional mechanisms to support mobile subscribers at vehicular speed and data authentication.” [1] The role of the WiMax forum is to define the profiles based on the available 802.16 options. These profiles include integration with other wireless access technologies, maintaining the quality of service (QoS) and transfer of security when handovers take place and user-network mutual authentication.

The paper [1] throws a light on the types of attacks made on the wireless networks and the encryption techniques used to keep the information secure.

2. Issues Addressed

Following are the issues addressed in [1]:

• • Classes of wireless attack: There are four major classes of attacks, namely, interception, fabrication, modification and interruption. “A fifth class of attacks-repudiation-is an attack against the accountability of information.” [1]

  • The layered architecture of WiMAX and the threats involved in the physical and Medium Access Control (MAC) layers of the model.

  • The wireless protocols used as the security infrastructure of wireless networks such as Wired Equivalent Privacy (WEP), Extensible Authenticated Protocol (EAP), Wi-Fi Protected Access (WPA) and Counter Mode with CBC-MAC (CCMP) or WPA2.

3. Core ideas for ensuring security in WiMAX network

3.1 WiMAX layered architecture

Figure 1: WiMAX/802.16 layered architecture [1]

The protocol architecture of WiMAX in figure 1 consists of physical layer and Medium Access Control (MAC) layer. The Service Access Points (SAP) are defined by the standard.

The common part sub-layer of the MAC layer exchanges the MAC Service Data Units (MAC SDU) with the convergence layer. “The Security sub-layer exchanges MAC Protocol Data Units (MAC PDU) with the physical layer.” [1] This security sub-layer is responsible for address authentication, establishing keys and encryption of the data. The convergence layer adapts the data either an IP packet or ATM cell coming from the higher layers into MAC SDU at the transmitter and vice-versa at the receiver.

3.2 Physical layer threats

Figure 2: Framing [1]

The flow of data (bits) are in the form of a sequence of frames which are of equal length. These frames are generally divided into two, namely, downlink sub-frame and an uplink sub-frame as shown in figure 2. Two modes of operation are Frequency Division Duplex (FDD) and Time Division Duplex (TDD). Here, TDD operation will be considered.

Figure 3: TDD downlink sub-frame [1]

Figure 3 illustrates the burst nature of the TDD downlink sub-frame. The downlink sub-frame consists of control information and data. A Mobile Station (MS) may receive only the burst frames and may also ignore the burst frames if the security layer does not allow them to demodulate if the physical layer is unsecured.

The attacks on the physical layer are jamming and scrambling. “Jamming is achieved by introducing a source of noise strong enough to significantly reduce the capacity of the channel.” [1] Jamming can be avoided using spread spectrum. Scrambling is a technique similar to jamming, targeted to specific or intended frames for short intervals of time. Scramblers are used to scramble control or management information to disrupt the normal functioning of the network.

3.3 MAC layer threats

The MAC layer is connection oriented and it consists of two types of connections, namely, management and data transport connections.

Figure 4: Security model [1]

The figure 4 shows a security model to explain the MAC layer threats. X.509 contains the Public Key (PK) of the MS, which it uses to get authenticated to the Base Station (BS) [1].

The Security Association is responsible for the security parameters of a connection such as keys and encryption algorithms [1]. There are three types of SAs, namely, primary SA, static SA and dynamic SA. Each of them has an SA identifier (SAID). “It also contains a cryptographic suite identifier (selected algorithms), Traffic Encryption Keys (TEKs) and initialization vectors (IV).” [1] Each MS is given one primary SA. The core entities are X.509 certificate, Authorization Key (AK), Key Encryption Key (KEK) and Hashed Message Authentication Code (HMAC) key. All the keys except the PK in X.509 are established during authorization.

The MAC layer consist of management messages which are unencrypted, thereby vulnerable to an eavesdrop attack. This attack is a major threat to the system and the attacker can steal valuable information such as victim’s location if not prevented.

When an attacker imitates a legitimate BS in order to attack the MSs, is called a rogue BS. The MSs would probably think that the BS is providing the service to them, but actually it is the rogue BS that has confused the MSs and is planning an attack on them. The Extensible Authentication Protocol (EAP) uses an authentication method known as EAP- Transport Layer Security (EAP-TLS) for authentication at the user-network level. EAP-TLS is based on the X.509 certificate. Strong authentication methods must be applied in WiMAX so that attacks are prevented.

3.4 Wireless protocols used to ensure security

3.4.1 Wired Equivalent Privacy (WEP)

Figure 5: WEP operation [1]

WEP is the most basic means to provide security to Wireless LANs (WLANs). Encryption is performed such that the transmission is encoded between an Access Point (AP) and the client.

The input frame comprises of header and payload as shown in figure 5. Before encryption is performed, the input frame is run through an integrity check algorithm which generates a hash called Integrity Check Value (ICV). The ICV comprises 32 bits. The ICV ensures that its contents are secured and not tampered before undergoing the encryption process by the RC4 algorithm.

WEP is vulnerable to attacks due to the following reasons:

§ The distribution of WEP keys is done manually. Hence it is time taking and a tedious job to perform.

§ If the keys are not changed often, then the attackers compile decryption dictionaries in which there are huge number of frames along with the same encrypted key which allows the user to use those frames to attack the wireless network.

§ The standard WEP implementation uses either 64-bit or 128-bit keys. Even though 128-bit keys are powerful to use, but it is still possible to crack the key in a short period if there exists a sustained level of traffic in the network.

§ RC4 algorithm is used for WEP. The statistics for the first few bytes at the output are non-random, due to which it is easy for the attacker to attack the network as the first few bits can be guessed for later attacks if there exists a loop hole in the algorithm.

3.4.2 Extensible Authentication Protocol (EAP)

It is used for the mutual authentication of management messages to prevent the attacks on the system. “Its framework supports multiple methods of authentication. Some of them include token cards, Public key authentication and one time password.” [1]

3.4.3 Wi-Fi Protected Access (WPA)

WPA was designed to replace the WEP. The Temporary Key Integrity Protocol (TKIP) is the protocol used for WPA. TKIP is backward compatible with existing devices and is designed as a software upgrade to WEP.

In WPA, the keys are automatically changed and not done manually as in WEP. Due to this the key does not remain identical for a long period of time and security of the network can be preserved. “WPA uses Message Integrity Checks (MIC) to ensure packet integrity.” [1] The replay attacks can be prevented by MIC by which an attacker resends the information from the source entity to the destination entity.

3.4.4 Counter Mode with CBC-MAC (CCMP) or WPA2

WPA2 is the latest version of WPA. They only differ in following the method of encryption. WPA (TKIP) uses RC4 algorithm whereas WPA2 uses Advanced Encryption Standard (AES) algorithm. Since WPA2 is an upgraded version of WPA, it is backward compatible with the existing hardware.

Figure 6: WPA2 operation [1]

The operation is as follows as shown in figure 6:

Transmission of CCMP data

§ Frame to be transmitted consists of MAC header and data.

§ “48-bit Packet Number (PN) is assigned. Additional Authentication Data (AAD) is constructed.” [1] AAD consists of fields in the frame header which must be authenticated for security but must also remain unencrypted [1].

§ Then a CCMP nonce is constructed that checks and guarantees that the encryption is taking place on the unique data.

§ Next, a CCMP header is built that consists of the packet number with a key identifier.

§ The entire above mentioned are given as input to the CCM encryption block.

§ “The encrypted frame is prepared for transmission by taking the original MAC header and appending the CCMP header and the encrypted data.” [1] This frame is transmitted over the wireless air interface.

Reception of CCMP data

§ “Ensure that the frame has not been corrupted.” [1]

§ The AAD is recovered from the frame received at the receiver. It consists of frame headers.

§ “The CCMP nonce is also recovered from the frame.” [1]

§ Decryption is done.

§ Integrity check is performed on plaintext and AAD.

§ “A plaintext frame is constructed from the MAC header and the data is recovered.” [1]

4. Potential applications of WiMAX

Applications of WiMAX are as follows:

§ Provides cellular backhaul networks.

§ VoIP/IPTV is provided with very high speeds.

§ Wireless broadband with very high speeds in rural areas where the connectivity of broadband is generally low.

§ Real-time videoconferencing from anywhere within the network.

5. Future directions for deploying security in WiMax

The deployment of WiMAX is a high boost to wireless technologies as its high speed and efficient services would soon result into a cable-free environment. Security must be at the top of the list as the customers would feel secure and opt for the usage of the high speed technology. Apart from security, the other attractive feature is WiMAX’s compatibility with other wireless access technologies such as Wi-Fi, GPRS and LTE.

6. Conclusion

The usage of effective encryption techniques and robust protocols along with Intrusion Prevention Systems (IPS) will prove a challenge against the attacks performed on the wireless networks.

7. Summary of the report

§ Critical threats include the eavesdropping of management messages which are more vulnerable to be attacked, which if attacked, can provide purposeful information to the attacker about the user, for example the user’s network infrastructure and presence.

§ Another major threat is jamming which can be done by using high gain antennas but can be prevented by using spreading techniques.

§ Security protocols like WEP, which uses the key which must be changed manually makes it a tedious task and more vulnerable to attacks if key is not updated often.

§ WPA uses RC4 algorithm to ensure security in wireless networks. WPA TKIP is backward compatible with hardware which use WEP as it is used as a replacement to the WEP.

§ CCMP or WPA2 uses AES algorithm technique to ensure security in wireless networks. WPA2 is the successor to WPA and is also backward compatible with the hardware.

8. Reference

[1] “WiMax security”, Nasreldin, M.; Asian, H.; El-Hennawy, M.; El-Hennawy, A.; Advanced Information Networking and Applications - Workshops, 2008. AINAW 2008. 22nd International Conference on, 25-28 March 2008, Digital Object Identifier 10.1109/WAINA.2008.190