1. Wireless LAN (WLAN) Networks
Sabita Maharjan
Simula Research Laboratory
24 April 2015

2. Agenda WLAN Overview Modulation Techniques Channel Access Mechanisms
Security Protocols

3. Agenda WLAN Overview Modulation Techniques Channel Access Mechanisms
Security Protocols

4. Wireless Local Area Network (WLAN)
WLAN is a wireless network that connects devices mainly using spread spectrum or OFDM techniques
Fig. 1: Typical WLAN Architecture (source.: Siemens)

5. Fig. 2: Encapsulation (source.: Siemens)

6. History of WLANs 2003 802.11g: 2.4 GHz, upto 54Mbps;
Performance similar to a;
Compatible with b devices
Standardization of WLAN: IEEE approved ,
2.4 GHz, 1-2 Mbps
IEEE approved n,
upto 600 Mbps
Optimizes modulation;
Uses multiple antennas
1999
802.11b: 2.4GHz, upto 11 Mbps;
802.11a: 5GHz, upto 54Mbps
The standard specifies the MAC and the physical layers for transmissions in the 2.4, 5.0 GHz band (ISM
…..
1997

7. Wireless LAN Components
Access point (AP)
Connects multiple wireless stations to the wired network
Wireless station

8. Wireless LAN Operating Modes: Infrastructure mode
Extended Service Set (ESS)
Multiple cells,
Two or more BSSs
Basic Service Set (BSS)
- One access point

9. Wireless LAN Operating Modes: Ad-hoc mode
Independent Basic Service Set (IBSS)

10. WLAN Characteristics Medium Interference/Noise
Variable quality (space/time)
Shared with unwanted WiFi devices
Shared with non-WiFi devices
Connectivity issues (Hidden node problem)
Mobility
Variation in link reliability
Power management: battery usage
Security issues
Radio resource management (RRM) is the system level control of co-channel interference and other radio transmission characteristics in wireless communication systems, for example cellular networks, wireless networks and broadcasting systems. RRM involves strategies and algorithms for controlling parameters such as transmit power, channel allocation, data rates, handover criteria, modulation scheme, error coding scheme, etc. The objective is to utilize the limited radio spectrum resources and radio network infrastructure as efficiently as possible.

11. Agenda WLAN Overview Modulation Techniques Channel Access Mechanisms
Security Protocols

12. Direct Sequence Spread Spectrum (DSSS)
Efficient modulation technique and good signal/noise properties.
Phase Shift Keying:
1 Mbit/s: Differential Binary PSK,
2 Mbit/s: Differential Quadrant PSK.
3 colocated channels available in the 2.4 GHz ISM band
Jamming/interference affects Signal/Noise ratio for entire channel
DSSS is a modulation technique that transmits the message signal using a wide(r) bandwidth
DSSS is more robust to interference and noise/jamming

13. Direct Sequence Spread Spectrum (DSSS)
The message signal modulates a pseudorandom noise/code (PRN)
source.: Siemens

14. DSSS Channels Non-overlapping DSSS Channels in the ISM band
Graphical representation of WiFi Channels in 2.4 GHz band

15. Frequency Hopping Spread Spectrum (FHSS)
FSK modulation
79 channels (2.4GHz GHz)
1 MHz Channel spacing
E.g., Multiple access method in the frequency-hopping CDMA (FD-CDMA).
FHSS rapidly switches a carrier among many frequency channels
Highly resistant to narrowband interference

16. FHSS Interference Avoidance
System performance metrics used commonly used for TPC
Transmit power control is a technical mechanism used within some networking devices in order to prevent too much unwanted interference between different wireless networks.
The network devices supporting the transmit power control feature are IEEE h Wireless LAN device in the 5 GHz band compliant to the IEEE a.

17. Orthogonal Frequency Division Multiplexing (OFDM)
The data is divided into a large number of radio frequencies (RFs)
Each RF carries a small part of the data
Each carrier is separately modulated by txn data using QAM or PSK.
Because of this robustness OFDM is used in broadband systems, such as digital TV en digital radio, in mobile systems, such as Flash OFDM, and in Radio LANs which have to operate in an environment with a lot of multipath fading.
OFDM is a technique that requires a lot of processing power. That is the reason that OFDM is used only since fairly recently.
The carriers are very close to each other but are orthogonal
OFDM is highly robust to frequency selective interference and fading, but it requires high processing power

18. Agenda WLAN Overview Modulation Techniques Channel Access Mechanisms
Security Protocols

19. WLAN Medium Access Methods
As the medium is shared, IEEE standard ensures that all nodes implement channel access methods
These methods address issues such as RF interference, denial-of-service attacks, and improve network throughput
IEEE mandates the use of DCF, a form of CSMA-CA
DCF: Distributed Coordination Function
DIFS: DCF Interframe Space = SIFS+(2*Slot Time)
SIFS: Short Interframe Space
PCF: Point Coordination Function
PIFS: PCF Interframe Space = SIFS+Slot Time
The DCF (Distributed Coordination Function) protocol controls access to the physical medium.
A station must sense the status of the wireless medium before transmission. If the station detects the medium as idle for DIFS duration, then, it can transmit. Otherwise backoff.
DIFS = IEEE b: Slot time: 20 micro s, DIFS = 50 micro s
CSMA-CA is a contention based protocol that all stations sense the medium before transmitting
RF: Radio Frequency, DCF: Distributed Coordination Function,
CSMA-CA: Carrier Sense Multiple Access with Collision Avoidance

20. Carrier sense multiple access with collision avoidance (CSMA-CA)
If a station that wants to transmit a frame, detects the energy in the channel above a certain threshold, it waits
It transmits only if the medium is free for more than DIFS
DCF: Distributed Coordination Function
DIFS: DCF Interframe Space = SIFS+(2*Slot Time)
SIFS: Short Interframe Space
PCF: Point Coordination Function
PIFS: PCF Interframe Space = SIFS+Slot Time
The DCF (Distributed Coordination Function) protocol controls access to the physical medium.
A station must sense the status of the wireless medium before transmission. If the station detects the medium as idle for DIFS duration, then, it can transmit. Otherwise backoff.
DIFS = IEEE b: Slot time: 20 micro s, DIFS = 50 micro s
Collision Avoidance
The stations make use of the acknowledgements that a receiver sends to a sender to verify the error-free reception
DIFS: DCF Interframe Space; DCF: Distributed Coordination Function

21. Carrier sense multiple access with collision avoidance (CSMA-CA)
DCF: Distributed Coordination Function
DIFS: DCF Interframe Space = SIFS+(2*Slot Time)
SIFS: Short Interframe Space
PCF: Point Coordination Function
PIFS: PCF Interframe Space = SIFS+Slot Time
The DCF (Distributed Coordination Function) protocol controls access to the physical medium.
A station must sense the status of the wireless medium before transmission. If the station detects the medium as idle for DIFS duration, then, it can transmit. Otherwise backoff.
DIFS = IEEE b: Slot time: 20 micro s, DIFS = 50 micro s
The size of the exponential backoff window increases with the number of retransmissions
DIFS: DCF Interframe Space; DCF: Distributed Coordination Function

22. Virtual carrier sense
Two stations belonging to the same BSS may not be within the radio range of each other
Neither of them can do a clear channel assessment through physical sensing: Hidden terminal problem
Virtual carrier sense mechanisms consists of a NAV maintained by each client
DCF: Distributed Coordination Function
DIFS: DCF Interframe Space = SIFS+(2*Slot Time)
SIFS: Short Interframe Space
PCF: Point Coordination Function
PIFS: PCF Interframe Space = SIFS+Slot Time
The DCF (Distributed Coordination Function) protocol controls access to the physical medium.
A station must sense the status of the wireless medium before transmission. If the station detects the medium as idle for DIFS duration, then, it can transmit. Otherwise backoff.
DIFS = IEEE b: Slot time: 20 micro s, DIFS = 50 micro s
NAV: Client’s prediction of how long the medium will be busy
NAV: Network Allocation Vector

23. Virtual carrier sense RTS: Request To Send; CTS: Clear To Send
DCF: Distributed Coordination Function
DIFS: DCF Interframe Space = SIFS+(2*Slot Time)
SIFS: Short Interframe Space
PCF: Point Coordination Function
PIFS: PCF Interframe Space = SIFS+Slot Time
The DCF (Distributed Coordination Function) protocol controls access to the physical medium.
A station must sense the status of the wireless medium before transmission. If the station detects the medium as idle for DIFS duration, then, it can transmit. Otherwise backoff.
DIFS = IEEE b: Slot time: 20 micro s, DIFS = 50 micro s
RTS: Request To Send; CTS: Clear To Send

24. DCF Protocol
A station utilizes the value in the duration field in the control field of others’ frames, indicating, how long the sender needs the medium
Stations must also check the duration field in addition to ensuring that no physically transmission is active
DCF supports the transmission of asynchronous signals
DCF: Distributed Coordination Function
DIFS: DCF Interframe Space = SIFS+(2*Slot Time)
SIFS: Short Interframe Space
PCF: Point Coordination Function
PIFS: PCF Interframe Space = SIFS+Slot Time
The DCF (Distributed Coordination Function) protocol controls access to the physical medium.
A station must sense the status of the wireless medium before transmission. If the station detects the medium as idle for DIFS duration, then, it can transmit. Otherwise backoff.
DIFS = IEEE b: Slot time: 20 micro s, DIFS = 50 micro s
Issues
RF Interference – incidental
Denial-of-service attack - Intentional
RF: Radio Frequency

25. PCF Protocol
As an optional method, IEEE defines the PCF, that enables the transmission of time sensitive information
A point control within the AP controls which stations can transmit within a given period of time
PCF is a contention-free protocol and enables frames to transmit data synchronously with regular time delays
DCF: Distributed Coordination Function
DIFS: DCF Interframe Space = SIFS+(2*Slot Time)
SIFS: Short Interframe Space
PCF: Point Coordination Function
PIFS: PCF Interframe Space = SIFS+Slot Time
The DCF (Distributed Coordination Function) protocol controls access to the physical medium.
A station must sense the status of the wireless medium before transmission. If the station detects the medium as idle for DIFS duration, then, it can transmit. Otherwise backoff.
DIFS = IEEE b: Slot time: 20 micro s, DIFS = 50 micro s
PCF thus effectively supports information flows requiring stricter synchronization such as video
PCF: Point Coordination Function

26. Agenda WLAN Overview Modulation Techniques Channel Access Mechanisms
Security Protocols

27. Types of Unauthorized Access
Accidental association
A terminal latches to an AP from a neighboring overlapping network
Malicious association
Malicious terminals act as “Soft APs”
Steal passwords, launch attacks to the wired n/w, plant trojans
Ad-hoc networks
Ad-hoc networks provide bridge to other networks, while they have little protection
Man-in-the-Middle Attacks
Denial-of-Service Attacks
Identity Thefts (MAC Spoofing)
Despite MAC filtering, programs and techniques exist to identify/steal the MAC address of the devices
…..

28. Open System Authentication Shared Key Authentication
WLAN Security
Authentication
Open System Authentication
Shared Key Authentication
The station uses RC4 (Rivest Cipher 4; A cryptographic technique) to encrypt the random number and then to send it back.
Authentication Request
Challenge (Random number)
Authentication Request
Encrypted Challenge
Authentication Response
Authentication Response

29. WLAN Security: Wired Equivalent Privacy (WEP) Model
BSS: Shared key is used between all stations and the APs
ESS: All APs have the same shared key
No key management
Shared key is manually entered into stations and APs
The password WEP uses can often be cracked in a few minutes with a basic laptop computer and widely available software tools.
Scalability issues are critical
WEP is the original security model (1999), but has distinct weaknesses and is outdated

30. WLAN Security Enhancement: Wi-Fi Protected Access (WPA)
WPA (2003) employs Temporary Key Integrity Protocol (TKIP) to enhance security of the keys used with WEP
WPA also uses RC4 stream cipher
WPA changes the way keys are derived and rotates keys more often for improved security
The password WEP uses can often be cracked in a few minutes with a basic laptop computer and widely available software tools.
WPA has an additional function called message integrity check function to prevent packet forgeries

31. WLAN Security Enhancement: WPA2
The WLAN security model currently in use is WPA2 (802.11i)
WPA2 uses Advanced Encryption Standard (AES) block cipher
WPA2 uses an encryption device that encrypts the network with a 256-bit key
The password WEP uses can often be cracked in a few minutes with a basic laptop computer and widely available software tools.
WPA2 uses an encryption device that encrypts the network with a 256-bit key; the longer key length improves security over WEP.

32. Discussion/Consideration: What is important in WLAN?
Reliability?
Throughput?
Latency?
Reliability?
Robustness?
Energy efficiency?
Scalability and Complexity?
“One size fits all” solution does not exist
Cyber Physical Systems:
Security, Reliability and Robustness?

33. Thank you!

34. CDMA
A Practical Approach provides a comprehensive look at the emerging paradigm of radio resource management-based applications and services

35. WLAN Standards

36. Active Scanning

37. Fragmentation RRM in 3G and 4G Cellular systems should consider
traffic arrivals
channel conditions
QoS classes
Long fragments higher probability of error
Microwave ovens interfere (4ms/4ms duty cycle)
Collision recovery is less expensive if we use fragmentation
Retransmission of fragments
MSDU
Hdr Body CRC
Hdr Body CRC
Hdr Body CRC

38. WLAN Security Wireless LAN uses radio signal
Attacker needs equipment capable of:
– monitoring (passive attacks) and transmitting (active attacks) encrypted traffic
 passive attacks can be carried out using off-the-shelf equipment by modifying driver settings
 active attacks are more difficult but not beyond reach and easy when firmware of PCMCIA cards can be upgraded
Prudent to assume that motivated attackers have full access to link layer for passive and active attacks