Attacks on PKM Protocols of IEEE 802.16 and Its Later Versions

Abstract

Without physical boundaries, a wireless network faces many more vulnerabilities than a wired network does. IEEE802.16 provides a security sublayer in the MAC layer to address the privacy issues across the fixed BWA (Broadband Wireless Access). Several articles have been published to address the flaws in IEEE802.16 security after IEEE802.16-2001 was released. However, even the enhanced version IEEE802.16-2004 does not settle all the problems and additional flaws emerge. In addition, we found that PKM (Privacy and Key Management) protocols version 2 (PKMv2), proposed by recently released IEEE802.16e, is also vulnerable to new attacks. In this paper, we first overview the IEEE802.16 standard, especially the security sublayer, and then investigate possible attacks on the basic PKM protocol in IEEE802.16 as well as in its other versions from related works and the newest PKMv2. We also give possible solutions to counter those attacks and verify our analysis using formal (BAN) logic.

WiFi and WiMAX Secure Deployments

“…The reason is that if BS has a timeout value to reject authorization requests (Auth-REQ) from the same SS within a certain period of time, the rightful request from the victim SS will be ignored and thereby leads to Denial of Service (DoS). In case where the BS accepts the requests, a new AK generation will take place continuously leading to exhaustion of the BS's capabilities [27]. In PKM v.2 RSA authentication, the BSNonce along with the SSNonce from the second message ensure freshness against replay attacks on the third message.…”

Security Enhencement & Solution for Authentication Frame work in IEEE 802.16

“…Backbone of interleaving attack is the re-transmission of a set of messages from the same session. The HA model proposes an approach to cater the interleaving attack by introducing transmission and storage overheads in the network [8].…”

“…This proposal claims to cater the effect of interleaving attacks discussed in [8] and [9] which may occur on PKM v2. The approach is presented for mobile WiMAX networks and enhances the PKM v2 authentication framework [8]. Hybrid authentication model is described in figure 5.…”

WIMAX/802.16 Broadband Wireless Networks

“…As suggested by Xu et al, mobility increases the vulnerability of authentication and key management protocols [18,19]. Multicast is another issue, where authentication and key management protocols should be revised to facilitate the multicast functions.…”