What is Wi-Max?

University of Maryland University College of Asia

Alvin William DeMore

Introduction

An explosion of mobile, wearable and traditional computing devices across the world, and their interconnections, has made computer security an area of paramount importance. Security is required for the computing host, applications running on it and the data being processed or exchanged between different applications or different hosts. In the security context, an application can be thought of as any executing thread or process, a host contains all such processes, and data is any information asset that can be accessed by an interactive user (Price, 2008, p. 170). A comprehensive definition of information security (IS) was given by the Committee on National Security Systems (CNSS): it is the protection of the critical elements of information, including usage, storage and transmission through systems and hardware components (Whitman & Mattord, 2012, p. 8). According to this model, IS has many aspects, such as physical protection of assets, protection against passive or active attacks, access control, risk minimization and assessment of threats and vulnerabilities (p. 11). Computer security is indeed a vast subject, and out of this I picked the specific subject of latest Wi-fi innovations. The reason is that wireless networking is being used more and more to connect various mobile devices and appliances, and I wish to research into this fast changing field. One of the new broadband wireless technologies being developed is WiMAX. This paper provides a brief overview of this emerging protocol and its implementation of security in terms of application, data and host.

Brief Overview of WiMAX

WiMAX, or Worldwide Interoperability for Microwave Access, is a Metropolitan Area Network (MAN) protocol based on the IEEE 802.16e-2005 standard. It works as a Broadband Wireless Access (BWA) system with applications in last-mile connectivity, mobile telephony, network backhauling, etc. (Nuaymi, 2007). WiMAX evolved from a series of precursor standards, such as the Wireless Internet Service Provider (WISP) of the late 1990s; the Local Multipoint Distribution System (LMDS) that utilized the 24-39 GHz portion; the Multichannel Multipoint Distribution System (MMDS) that utilized the 2.5 GHz band; etc. A schematic diagram of the technology is presented in Figure 1:

[pic]

Figure 1: Simplified representation of WiMAX technology showing both fixed and mobile usage. Source: Tang, Muller & Shariff, 2010, p. 7.

The IEEE implementation of the BWA 802.16 standard has two usage targets: the IEEE 802.16-2004 (802.16d) for fixed wireless access at home; and the revised IEEE 802.16e-2005 (802.16e) for mobile users who need fast, uninterrupted switching between cells. Compared to other wireless standards such as “Wi-Fi” or “Bluetooth”, WiMAX offers a greater range of up to 20 Km, while a few thousand clients can be simultaneously serviced by a single base station. The technology achieves typical transmission rates of 10 Mb/s, going up to 70 Mb/s under test conditions with a small number of users. While it can operate on the entire spectrum between 2-11 GHz, and use both licensed and unlicensed portions of it, practical usage is restricted to the 2.5 GHz, 3.5 GHz and 5.7 GHz bands. It is based on Orthogonal Frequency Division Multiplexing (OFDM), and uses the IP packet-based system for delivering voice and/or data packets (Abate, 2009). The WiMAX implementation concerns itself only with the physical (Layer 1) and MAC (Layer 2) strata, leaving the network (Layer 3) stratum open to innovations by 3rd party vendors. The high Line-Of-Sight (LOS) offered by WiMAX makes it particularly suitable for mobile internet access, whereby users can simply plug-in their WiMAX enabled clients into their laptops for seamless connectivity. In addition to implementing Quality of Service (QOS) features for voice and streaming applications, WiMAX also offers better security, with support for multi-level encryption at various points of the network, and guaranteed security mechanisms implemented through a separate security sub-layer (Tang, Muller and Sharif (Eds.), 2010).

Because of these advanced features, WiMAX has been sometimes described as “wireless on steroids”, and it is one of the most promising new technologies that are being evaluated by service providers across the world.

Security Implementation in WiMAX

Strong security was one of the design goals of WiMAX and has therefore been implemented as a separate sub-layer, called privacy and key management (PKM), within its MAC layer. This sub-layer can be used to provide message authentication via the HMAC or CMAC schemes, provide device or user authentication via the EAP method, and endure data confidentiality via the AES-CCM encryption algorithm (Shon et al., 2010, p. 1). Implementation of end-to-end security and quality of service (QoS) by WiMAX vendors is mandatory.

The WiMAX uses two types PKM security associations (SAs) – data and authorization. Data SA specifies the encryption method and algorithms for data communication between the base station (BS) and each user, also called subscriber station (SS). It is comprised of an authorization ID (SAID), encryption to protect message confidentiality, two traffic encryption keys (TEKs) with their own identifiers, a TEK lifetime, and an indicator specifying whether the SA is primary or dynamic. The authorization SA contains a user credential, authorization key (AK) with its identifier and lifetime, a key encrypting key (KEK), a downstream message identification key that uses a hash function (DHMAC), a corresponding upstream hashing key (UHMAC) and a set of authorized data SAs (Fernandez & VanHilst, 2008, p. 200). The SS can enter the network by sending a request to the BS that encrypted with its own 48-bit MAC ID and a manufacturer suppied X.509 certificate. Reply from the BS is in turn encrypted with its public key and this is followed by encrypted message transmission (p. 203). A complete overview of the WiMAX PKM is presented in Figure 2:

[pic]

Figure 2: Security implementation in WiMAX in the form of privacy and key management. Source: Fernandez & VanHilst, 2008, p. 200.

Attacks and Countermeasures in WiMAX
Although WiMAX has several attractive security features especially as a MAN protocol, there are several known exploits against both its physical layer and MAC layer – and appropriate countermeasures have also been developed in some cases. Some of these attacks are only theoretical, while others have actually been tested under operational conditions. The newest management version, PKMv.3, has not been properly examined by the community yet, so the exploits discussed here are based on PKMv.2. Attacks on the WiMAX security mechanism can be divided into several types, including handover, power saving, ranging, multicast/broadcast, mesh mode and control message attacks (Kolias, Kambourakis, & Gritzalis, 2013, p. 503). To pick one of these attack types, ranging is a network entry procedure in which the BS and SS agree on the correct timing and power offsets for their chosen physical connection mode. However, ranging occurs not only during initial connection, but periodically during the entire session. The latter messages are stateless and do not have encryption or identity protection, and this fact can be exploited in several ways. One method, known as RNG-RSP DoS attack, can be used against a single BS as well as multiple BSs; however, it requires knowledge of the Initial Ranging Connection Identifier (CID) being used by the intended victim (or SS). The attacker obtains the necessary CID by sniffing management messages between the BS and SS, creates a forged RNG-RSP message with “abort status” and sends it to the victim, forcing her to disconnect from the network, resulting in a denial of service. A variant of this exploit forces the victim to switch her channel, whereupon the SS must rescan for an available channel. Several attackers can collaborate to create distributed DoS (DDoS) attacks, with possibly disastrous consequences for the entire network (Bhargava et al., 2009, p. 375).

These exploits can be prevented by improving security of management messages. Naseer et al. (2008, p. 344) proposed implementation of a Diffie-Hellman key exchange protocol, with the public/private key pair being generated on the basis of the user’s basic CID and the initial ranging codes of the BS. This would enable both the BS and SS to know the correct keys and thus authenticate each other. Another countermeasure is improving security of the PKM itself, for example by creation of timestamps that would thwart replay exploits. A further improvement is combining timestamps with nonces, which has the further advantage that clock synchronization between the BS and SS is not essential (). The TEK sequence number can also be increased from 2 bits to at least 12 bits, thus exponentially increasing the number of keys (Sreejesh & Sebastian, 2010, p. 34).

Conclusion

Computer security is an ever changing field, with new exploits and their countermeasures being announced almost every day. The use of wireless communication networks for the delivery of a wide variety of services, ranging from personal to enterprise to financial, is only making the implementation of strong wireless security all the more essential. As vendors come up with new protocols and service delivery mechanisms, it is to be hoped that various standards bodies will also strive to keep devices, applications and data secure.

References

Abate, Z. (2009). WiMax RF systems engineering. Norwood: Artech House.

Bhargava, B. et al. (2009). Collaborative attacks in WiMAX networks. Security and Communication Networks, 2, 373–391.

Fernandez, E. B. & VanHilst, M. (2008). An Overview of WiMAX Security. In S. Ahson & M. Ilyas (Eds.), WiMAX standards and security (197-204). Boca Raton, FL: CRC Press.

Kolias, C., Kambourakis, G., & Gritzalis, S. (2013). Attacks and Countermeasures on 802.16: Analysis and Assessment. IEEE Communications Surveys & Tutorials, 15(1), 487-514.

Naseer, S., Younus, M., & Ahmed, A. (2008). Vulnerabilities Exposing IEEE 802.16e Networks to DoS Attacks: A Survey. In Ninth ACIS International Conference on Software Engineering, Artificial Intelligence, Networking, and Parallel/Distributed Computing, SNPD ’08, 344-349.

Nuaymi, L. (2007). WiMAX: technology for broadband wireless access. Chichester: Wiley.

Price, S. M. (2008). Host-Based Security Challenges and Controls: A Survey of Contemporary Research. Information Security Journal: A Global Perspective, 17, 170-178.

Shon, T. et al. (2010). Novel Approaches to Enhance Mobile WiMAX Security. EURASIP Journal on Wireless Communications and Networking, 2010, 1-11.

Sreejesh, S. & Sebastian, M. P. (2010). A Revised Secure Authentication Protocol for IEEE 802.16 (e). In International Conference on Advances in Computer Engineering (ACE), 34-38.

Tang, S. Y., Muller, P., & Shariff, H. (Eds.). (2010). WiMAX Security and Quality of Service: An End-to-End Perspective. Chichester: Wiley.

Whitman, M. E. & Mattord, H. J. (2012). Principles of information security, 4th Ed. Boston, MA: Course Technology Cengage Learning.