Security and Privacy Issues in Wireless Mesh Networks: A Survey

This book chapter identifies various security threats in wireless mesh network (WMN). Keeping in mind the critical requirement of security and user privacy in WMNs, this chapter provides a comprehensive overview of various possible attacks on different layers of the communication protocol stack for WMNs and their corresponding defense mechanisms. First, it identifies the security vulnerabilities in the physical, link, network, transport, application layers. Furthermore, various possible attacks on the key management protocols, user authentication and access control protocols, and user privacy preservation protocols are presented. After enumerating various possible attacks, the chapter provides a detailed discussion on various existing security mechanisms and protocols to defend against and wherever possible prevent the possible attacks. Comparative analyses are also presented on the security schemes with regards to the cryptographic schemes used, key management strategies deployed, use of any trusted third party, computation and communication overhead involved etc. The chapter then presents a brief discussion on various trust management approaches for WMNs since trust and reputation-based schemes are increasingly becoming popular for enforcing security in wireless networks. A number of open problems in security and privacy issues for WMNs are subsequently discussed before the chapter is finally concluded.Comment: 62 pages, 12 figures, 6 tables. This chapter is an extension of the author's previous submission in arXiv submission: arXiv:1102.1226. There are some text overlaps with the previous submissio

A Unified Mobility Management Architecture for Interworked Heterogeneous Mobile Networks

The buzzword of this decade has been convergence: the convergence of telecommunications, Internet, entertainment, and information technologies for the seamless provisioning of multimedia services across different network types. Thus the future Next Generation Mobile Network (NGMN) can be envisioned as a group of co-existing heterogeneous mobile data networking technologies sharing a common Internet Protocol (IP) based backbone. In such all-IP based heterogeneous networking environments, ongoing sessions from roaming users are subjected to frequent vertical handoffs across network boundaries. Therefore, ensuring uninterrupted service continuity during session handoffs requires successful mobility and session management mechanisms to be implemented in these participating access networks. Therefore, it is essential for a common interworking framework to be in place for ensuring seamless service continuity over dissimilar networks to enable a potential user to freely roam from one network to another. For the best of our knowledge, the need for a suitable unified mobility and session management framework for the NGMN has not been successfully addressed as yet. This can be seen as the primary motivation of this research. Therefore, the key objectives of this thesis can be stated as: To propose a mobility-aware novel architecture for interworking between heterogeneous mobile data networks To propose a framework for facilitating unified real-time session management (inclusive of session establishment and seamless session handoff) across these different networks. In order to achieve the above goals, an interworking architecture is designed by incorporating the IP Multimedia Subsystem (IMS) as the coupling mediator between dissipate mobile data networking technologies. Subsequently, two different mobility management frameworks are proposed and implemented over the initial interworking architectural design. The first mobility management framework is fully handled by the IMS at the Application Layer. This framework is primarily dependant on the IMS’s default session management protocol, which is the Session Initiation Protocol (SIP). The second framework is a combined method based on SIP and the Mobile IP (MIP) protocols, which is essentially operated at the Network Layer. An analytical model is derived for evaluating the proposed scheme for analyzing the network Quality of Service (QoS) metrics and measures involved in session mobility management for the proposed mobility management frameworks. More precisely, these analyzed QoS metrics include vertical handoff delay, transient packet loss, jitter, and signaling overhead/cost. The results of the QoS analysis indicates that a MIP-SIP based mobility management framework performs better than its predecessor, the Pure-SIP based mobility management method. Also, the analysis results indicate that the QoS performances for the investigated parameters are within acceptable levels for real-time VoIP conversations. An OPNET based simulation platform is also used for modeling the proposed mobility management frameworks. All simulated scenarios prove to be capable of performing successful VoIP session handoffs between dissimilar networks whilst maintaining acceptable QoS levels. Lastly, based on the findings, the contributions made by this thesis can be summarized as: The development of a novel framework for interworked heterogeneous mobile data networks in a NGMN environment. The final design conveniently enables 3G cellular technologies (such as the Universal Mobile Telecommunications Systems (UMTS) or Code Division Multiple Access 2000 (CDMA2000) type systems), Wireless Local Area Networking (WLAN) technologies, and Wireless Metropolitan Area Networking (WMAN) technologies (e.g., Broadband Wireless Access (BWA) systems such as WiMAX) to interwork under a common signaling platform. The introduction of a novel unified/centralized mobility and session management platform by exploiting the IMS as a universal coupling mediator for real-time session negotiation and management. This enables a roaming user to seamlessly handoff sessions between different heterogeneous networks. As secondary outcomes of this thesis, an analytical framework and an OPNET simulation framework are developed for analyzing vertical handoff performance. This OPNET simulation platform is suitable for commercial use

Mobile Voice Over IP (MVOIP): An Application-level Protocol

Current Voice over Internet Protocol (VOIP) protocols require participating hosts to have fixed IP addresses for the duration of a VOIP call. When using a wireless-enabled host, such as a tablet computer on an 802.11 wireless network, it is possible for a participant in a VOIP call to roam around the network, moving from one subnet to another and needing to change IP addresses. This address change creates the need for mobility support in VOIP applications. We present the design of Mobile Voice over IP (MVOIP), an application-level protocol that enables such mobility in a VOIP application based on the ITU H.323 protocol stack. An MVOIP application uses hints from the surrounding network to determine that it has switched subnets. It then initiates a hand-off procedure that comprises pausing its current calls, obtaining a valid IP address for the current subnet, and reconnecting to the remote party with whom it was in a call. Testing the system shows that on a Windows 2000 platform there is a perceivable delay in the hand-off process, most of which is spent in the Windows API for obtaining DHCP addresses. Despite this bottleneck, MVOIP works well on a wireless network

Context transfer support for mobility management in all-IP networks.

This thesis is a description of the research undertaken in the course of the PhD and evolves around a context transfer protocol which aims to complement and support mobility management in next generation mobile networks. Based on the literature review, it was identified that there is more to mobility management than handover management and the successful change of routing paths. Supportive mechanisms like fast handover, candidate access router discovery and context transfer can significantly contribute towards achieving seamless handover which is especially important in the case of real time services. The work focused on context transfer motivated by the fact that it could offer great benefits to session re-establishment during the handover operation of a mobile user and preliminary testbed observations illustrated the need for achieving this. Context transfer aims to minimize the impact of certain transport, routing, security-related services on the handover performance. When a mobile node (MN) moves to a new subnet it needs to continue such services that have already been established at the previous subnet. Examples of such services include AAA profile, IPsec state, header compression, QoS policy etc. Re-establishing these services at the new subnet will require a considerable amount of time for the protocol exchanges and as a result time- sensitive real-time traffic will suffer during this time. By transferring state to the new domain candidate services will be quickly re-established. This would also contribute to the seamless operation of application streams and could reduce susceptibility to errors. Furthermore, re-initiation to and from the mobile node will be avoided hence wireless bandwidth efficiency will be conserved. In this research an extension to mobility protocols was proposed for supporting state forwarding capabilities. The idea of forwarding states was also explored for remotely reconfiguring middleboxes to avoid any interruption of a mobile users' sessions or services. Finally a context transfer module was proposed to facilitate the integration of such a mechanism in next generation architectures. The proposals were evaluated analytically, via simulations or via testbed implementation depending on the scenario investigated. The results demonstrated that the proposed solutions can minimize the impact of security services like authentication, authorization and firewalls on a mobile user's multimedia sessions and thus improving the overall handover performance

SD-MCAN: A Software-Defined Solution for IP Mobility in Campus Area Networks

Campus Area Networks (CANs) are a subset of enterprise networks, comprised of a network core connecting multiple Local Area Networks (LANs) across a college campus. Traditionally, hosts connect to the CAN via a single point of attachment; however, the past decade has seen the employment of mobile computing rise dramatically. Mobile devices must obtain new Internet Protocol (IP) addresses at each LAN as they migrate, wasting address space and disrupting host services. To prevent these issues, modern CANs should support IP mobility: allowing devices to keep a single IP address as they migrate between LANs with low-latency handoffs. Traditional approaches to mobility may be difficult to deploy and often lead to inefficient routing, but Software-Defined Networking (SDN) provides an intriguing alternative. This thesis identifies necessary requirements for a software-defined IP mobility system and then proposes one such system, the Software-Defined Mobile Campus Area Network (SD-MCAN) architecture. SD-MCAN employs an OpenFlow-based hybrid, label-switched routing scheme to efficiently route traffic flows between mobile hosts on the CAN. The proposed architecture is then implemented as an application on the existing POX controller and evaluated on virtual and hardware testbeds. Experimental results show that SD-MCAN can process handoffs with less than 90 ms latency, suggesting that the system can support data-intensive services on mobile host devices. Finally, the POX prototype is open-sourced to aid in future research

QoS Provisioning for Multi-Class Traffic in Wireless Networks

Physical constraints, bandwidth constraints and host mobility all contribute to the difficulty of providing Quality of Service (QoS) guarantees in wireless networks. There is a growing demand for wireless networks to support all the services that are available on wired networks. These diverse services, such as email, instant messaging, web browsing, video conferencing, telephony and paging all place different demands on the network, making QoS provisioning for wireless networks that carry multiple classes of traffic a complex problem. We have developed a set of admission control and resource reservation schemes for QoS provisioning in multi-class wireless networks. We present three variations of a novel resource borrowing scheme for cellular networks that exploits the ability of some multimedia applications to adapt to transient fluctuations in the supplied resources. The first of the schemes is shown to be proportionally fair: the second scheme is max-min fair. The third scheme for cellular networks uses knowledge about the relationship between streams that together comprise a multimedia session in order to further improve performance. We also present a predictive resource reservation scheme for LEO satellite networks that exploits the regularity of the movement patterns of mobile hosts in LEO satellite networks. We have developed the cellular network simulator (CNS) for evaluating call-level QoS provisioning schemes. QoS at the call-level is concerned with call blocking probability (CBP), call dropping probability (CDP), and supplied bandwidth. We introduce two novel QoS parameters that relate to supplied bandwidth—the average percent of desired bandwidth supplied (DBS), and the percent of time spent operating at the desired bandwidth level (DBT)

Comparison of vertical handover decision-based techniques in heterogeneous networks

Industry leaders are currently setting out standards for 5G Networks projected for 2020 or even sooner. Future generation networks will be heterogeneous in nature because no single network type is capable of optimally meeting all the rapid changes in customer demands. Heterogeneous networks are typically characterized by some network architecture, base stations of varying transmission power, transmission solutions and the deployment of a mix of technologies (multiple radio access technologies). In heterogeneous networks, the processes involved when a mobile node successfully switches from one radio access technology to the other for the purpose of quality of service continuity is termed vertical handover or vertical handoff. Active calls that get dropped, or cases where there is discontinuity of service experienced by mobile users can be attributed to the phenomenon of delayed handover or an outright case of an unsuccessful handover procedure. This dissertation analyses the performance of a fuzzy-based VHO algorithm scheme in a Wi-Fi, WiMAX, UMTS and LTE integrated network using the OMNeT++ discrete event simulator. The loose coupling type network architecture is adopted and results of the simulation are analysed and compared for the two major categories of handover basis; multiple and single criteria based handover methods. The key performance indices from the simulations showed better overall throughput, better call dropped rate and shorter handover time duration for the multiple criteria based decision method compared to the single criteria based technique. This work also touches on current trends, challenges in area of seamless handover and initiatives for future Networks (Next Generation Heterogeneous Networks)

QoS provisioning and mobility management for IP-based wireless LAN

Today two major technological forces drive the telecommunication era: the wireless cellular systems and the Internet. As these forces converge, the demand for new services, increasing bandwidth and ubiquitous connectivity continuously grows. The next-generation mobile systems will be based solely or in a large extent, on the Internet Protocol (IP). This thesis begins by addressing the problems and challenges faced in a multimedia, IP-based Wireless LAN environment. The ETSI HiperLAN/2 system has been mainly selected as the test wireless network for our theoretical and simulation experiments. Apart from the simulations, measurements have been taken from real life test scenarios, where the IEEE 802.11 system was used (UniS Test-bed). Furthermore, a brief overview of the All-IP network infrastructure is presented. An extension to the conventional wireless (cellular) architecture, which takes advantage of the IP network characteristics, is considered. Some of the trends driving the 3G and WLANs developments are explored, while the provision of quality of service on the latter for real-time and non-real-time multimedia services is investigated, simulated and evaluated. Finally, an efficient and catholic Q0S framework is proposed. At the same time, the multimedia services should be offered in a seamless and uninterrupted manner to users who access the all-IP infrastructure via a WLAN, meeting the demands of both enterprise and public environments anywhere and anytime. Thus providing support for mobile communications not only in terms of terminal mobility, as is currently the case, but also for session, service and personal mobility. Furthermore, this mobility should be available over heterogeneous networks, such as WLANs, IJMTS, as well as fixed networks. Therefore, this work investigates issues such as, multilayer and multi-protocol (SIP-Mobile IP-Cellular IP) mobility management in wireless LAN and 3G domains. Several local and global mobility protocols and architectures have been tested and evaluated and a complete mobility management framework is proposed. Moreover, integration of simple yet efficient authentication, accounting and authorisation mechanisms with the multimedia service architecture is an important issue of IP-based WLANs. Without such integration providers will not have the necessary means to control their provided services and make revenue from the users. The proposed AAA architecture should support a robust AAA infrastructure providing secure, fast and seamless access granting to multimedia services. On the other hand, a user wishing a service from the All-IP WLAN infrastructure needs to be authenticated twice, once to get access to the network and the other one should be granted for the required service. Hence, we provide insights into these issues by simulating and evaluating pre-authentication techniques and other network authentication scenarios based on the wellknown IEEE 802.lx protocol for multimedia IP-based WLANs.EThOS - Electronic Theses Online ServiceGBUnited Kingdo