Effective Authentication Technique for Distributed Denial of Service Attacks in Wireless Local Area Networks

Over the past few years, wireless local area networks (WLANs) have gained an increased attention and a large number of WLANs are being deployed in universities, companies, airports etc. Majority of the IEEE 802.11 based WLANs employ distributed coordination function (DCF) in wireless access points (AP) to arbitrate the wireless channel among Wireless Stations (STAs). However, DCF poses serious unfairness problem between uplink and downlink flows. To overcome this unfairness problem, we propose a simple enhancement to the IEEE 802.11 DCF which provides priority to the AP and thus enables it to acquire a larger share of the channel when required. We have demonstrated the unfairness problem through systematic measurements in an experimental test bed of WLAN using the legacy 802.11 DCF. We also developed analytical models to calculate the throughput of AP and the STAs and verify these results through thorough simulations in ns-2. We observe that our simulation results find in good agreement with our analytical models. Results show that our proposed enhancement achieves a fair distribution of bandwidth and improves the throughput (by nearly 300%) for the downlink flows as compared to the DCF, without severely affecting the performance of uplink flows

In dense wireless local area network (WLAN) environments, the haphazard deployment of WLAN devices causes them to overlap. In such situations, a coverage adaptation through transmission power control (TPC) is required. At the same time, coverage holes should be taken into consideration for connectivity maintenance among devices. In this paper, a TPC scheme is proposed that reduces overlaps in an autonomous manner, without generating target coverage holes. The problem is formulated as a target coverage problem, in which wireless stations (STAs) are treated as target points, and the transmission power is appropriately controlled by the proposed scheme. In addition, we prove that the target coverage game is a potential game, and the proposed method is guaranteed to converge to a Nash equilibrium after a finite number of iterations. In order to prevent the occurrence of coverage holes that cannot be detected by the available STA information, we propose the exclusion of coverage boundary access points (APs) from reducing transmission power, with the idea that each boundary AP always contains the region covered by it alone. The coverage boundary APs are determined through Delaunay triangulation of all APs. The proposed scheme is evaluated by performing some simulations. The simulation results indicate that the proposed TPC scheme is effective in reducing coverage overlaps without generating coverage holes.

Automated interference detection is required for operation and management services in wireless networks as Wireless Local Area Networks (WLANs) based on IEEE 802.11 Standard since co-channel interference from other wireless transmitters occurs irregularly. We propose a new approach for detecting the presence of interference on 802.11 links. Our solution focuses on the Access Point (AP)-initiated monitoring approach without Wireless Station (STA)-initiated additional function and sniffer devices. Our approach uses the geographical distribution of the response delay of the Acknowledgment packet (ACK) to the downlink packet that AP transmitted to STAs. The proposed method consists of a continuous monitoring step and a periodical diagnosis step to measure network statistics by ACK response delay between an AP and STAs and to detect whether and where interference occurs respectively. Comprehensive simulation results show that the proposed approach has a good accuracy and low misdetection ratio for diagnosing the interference existence and location in IEEE 802.11 WLANs.

While the wireless local area network (WLAN) has been the most common technology for static indoor wireless services, its applications has limited performance in seamless mobile services because of its inherent static service transaction mechanisms. In this paper, we propose a mobility provisioning handoff method called dual cross-linking method to support seamless services in WLAN. A mobile node (MN) has two wireless interfaces and access points (APs) are controlled by a mobility management (MM) agent. In the area where the service areas of two adjacent APs are overlapped, one wireless interface is used to maintain the wireless services while the other interface searches for a next available AP. After finding a new AP, MN forms dual communication path from the MM to the MN so that the MN is ready to move to a newly found AP service area without service loss. Once the MN is moved to a new AP area, the first interface is disconnected leaving only one interface connection. It was proved that the proposed method can effectively reduce the handoff delay and packet loss through the analysis.

We present a fast and efficient way of switching a wireless node (WN) between different Access Points (AP) in an Infrastructure Wireless Network. Our proposed model adheres to the security standards set by IEEE 802.11i draft. New architectures like 802.11i and Robust Secure Network (RSN) mainly depend on the 802.1x communication between a Wireless supplicant node and an Authentication Server (AS) followed by a 4-Way handshake between Wireless Supplicant node and Access Point. Reassociation with another AP also requires a four way handshake. We propose two models for transitions. The first model is based on Distributed approach while the second one is based on Centralized approach. Distributed model involves AP to AP direct communication without the involvement of AS while in Centralized model APs communicate through AS. We show that both the models are very efficient, secure and deny any kind of man in the middle attack, any rogue attack by wireless node or an AP and any kind of Denial of Service attack. Finally, we show that Centralized model has a little edge over the distributed model.

Recently, IEEE 802.11 wireless LAN (WLAN) has emerged as a widely accepted technology for broadband wireless networking. A WLAN handoff operation, which occurs when a wireless station (STA) changes its association from one access point (AP) to another, has not been well understood so far since the mobility has not been a major concern for typical WLAN environments. However, the mobility within WLAN is becoming more and more important as the portable WLAN devices, e.g., voice over WLAN (VoWLAN) devices, emerge today. In this paper, we introduce an empirical approach to evaluate the 802.11 handoff process in a public WLAN service network, i.e., KT (Korea Telecom) NESPOT. We analyze the handoff delay by characterizing individual delay components in terms of protocol-oriented delays and network configuration-dependent ones. From the analysis, we identify that the user authentication-related procedure, especially, with delay terms not rooted in the employed protocols, could become a major delay in a public service WLAN, and hence should be reduced in order to achieve a faster handoff

This paper describes an experimental implementation of a variation of the Reverse Direction (RD) Medium Access Control (MAC) Protocol (RDP) defined in the IEEE 802.11n using the Wireless Open-Access Research Platform (WARP). The proposed approach, named Bidirectional MAC (BidMAC), allows the receiver of a valid data sequence to perform an RD transmission to the transmitter without contending for the channel. Whereas in RDP the RD transmission must be initiated by the transmitter, in BidMAC it can be dynamically initiated by the receiver according to its traffic requirements. Previous results based on mathematical analyses and computer-based simulations have shown that BidMAC can better balance downlink and uplink transmission opportunities in a Wireless Local Area Network (WLAN) where the Access Point (AP) handles bidirectional data flows for some of its wireless stations (STAs). This paper aims at going one step further and demonstrating that such superior performance can be attained in real environments. Towards this end, an implementation of BidMAC has been carried out in a reference design of WARP compatible with the IEEE 802.11a/g and tested in a proof-of-concept network formed by an AP and two STAs. Experimental results confirm the superior performance of BidMAC when compared to the legacy Distributed Coordination Function (DCF) of the IEEE 802.11 versus the traffic load, packet length, and data rate, yielding gains of up to 60%.*

The Distributed Coordination Function (DCF) is the fundamental access method defined in the IEEE 802.11 Standard for Wireless Local Area Networks (WLANs). With this standard, the Access Point (AP) and the mobile stations consume a significant amount of energy to contend for access to the shared wireless channel. In order to improve the energy efficiency of WLANs, we investigate in this paper a simple and backwards compatible mechanism, called Bi-Directional DCF (BD-DCF), that enables bidirectional communications between wireless stations with a single channel access invocation. The key idea is to let the AP or any mobile station transmit a data packet together with the acknowledgement upon the successful reception of a data packet. This approach reduces the communication overhead, the channel contention, and better balances uplink and downlink transmission opportunities. We evaluate the performance of the proposed BD-DCF by means of computer-based simulation considering different traffic loads, degrees of traffic symmetry, data packet sizes, and data rates. The results presented in this paper show that the BD-DCF protocol can improve the energy efficiency of DCF up to 50%.

Wireless stations (WSs) in an IEEE 802.11 access network compete with each other for collective bandwidth offered by access points (APs). The competition involves selecting an AP with the consideration of potential link rate and workload status. From the perspective of system, a good AP selection policy should be stable, increase overall system throughput, and maintain bandwidth fairness among WSs. This paper models AP selections under the framework of game theory, where each WS's sole goal is to maximize its achievable throughput. The achievable throughput depends on not only the number of WSs that associate with the same AP but the set of link rates these WSs use as well. It is not a monotonically decreasing function of WS population when considering the effect of performance anomaly. We have proven the stability of this game (Nash equilibrium) and shown that selfish behavior of individual WSs in fact improves overall bandwidth fairness among WSs. Thorough simulations were conducted to demonstrate the validity of the analytical results and compare the performance of the proposed game with that of counterparts.

Nowadays, wireless LAN has become the most widely deployed technology in mobile devices for providing Internet access. Operators and service providers remarkably increase the density of wireless access points in order to provide their subscribers with better connectivity and user experience. As a result, WLAN users usually find themselves covered by multiple access points and have to decide which one to associate with. In traditional implementations, most wireless stations would select the access point with the strongest signal, regardless of traffic load on that access point, which might result in heavy congestion and unfair load. In this paper, we propose a novel on-line association algorithm to deal with any sequence of STAs during a long-term time such as one day. the performance of our algorithm is evaluated through simulation and experiments. Simulation results show that our algorithm improves the overall WLAN throughput by up to 37%, compared with the conventional RSSI-based approach. Our algorithm also performs better than SSF (Strongest Signal First) and LAB (Largest Available Bandwidth) in the experiments.

With the fast-growing demand for mobile services, where to place the access points (APs) for providing uniformly and appropriately distributed signals in a wireless local area network (WLAN) becomes an important issue in the wireless network planning. Basically, AP placement will affect the coverage and strength of signals in a WLAN. The number and locations of APs in a WLAN are often decided on the basis of the trial-and-error method. Based on this method, the network planner first selects suitable locations to place APs through observation, and then keeps changing the locations to improve the signal strength based on the received signal. Such process is complicated, laborious and time-consuming. To overcome this problem, we investigate the back-propagation neural network (BPNN) algorithm to improve over the traditional trial-and-error method. Without increasing the number of APs, our approach only needs to adjust AP locations to overcome weak signal problems and thus increase the signal coverage for the Internet connection anywhere within the area. In our experiment, we established a WLAN on a C campus. Our experiments also indicate that placing APs according to the BPNN provided better signal coverage and met the students’ demands for connecting to the Internet from anywhere in the classroom.

Chapter 3 - Wireless Network Physical Architecture

PurposeWireless local area networks (WLANs) are the predominant option for broadband wireless access network, and multiple access points (APs) will be much more available for wireless stations (WSTAs). Call admission control (CAC) on AP selection problem over 802.11 WLAN is a critical issue. In the existing architecture, strongest‐signal‐first is the default AP selection mechanism in 802.11 WLAN which uses the single criterion, received signal strength indicator, to select AP. However, this method suffers from bandwidth deficiency and unbalanced load among APs due to the uneven distribution of user load, thus degrading the system throughput. Instead, the purpose of this paper is to propose a multi‐criteria CAC on AP selection algorithms.Design/methodology/approachThe distributed multi‐criteria considered in order are RSSI, minimum required bandwidth of WSTA, estimated effective bandwidth (EEB) and AP‐WSTA distance. A semiMarkov model considering both packet retransmission limit, packet error rate and collision effect is proposed to predict the system throughput and validated through simulation results. Two multi‐criteria AP selection algorithms after EEB is evaluated are proposed and compared based on this analytical model.FindingsThe proposed algorithms outperform the traditional SSF algorithm in terms of the balance index for AP and the average system throughput.Originality/valveThe paper presents performance analysis for multi‐criteria CAC for distributed access point selection in WLANs.

We explore the use of clock skew of a wireless local area network access point (AP) as its fingerprint to detect unauthorized APs quickly and accurately. The main goal behind using clock skews is to overcome one of the major limitations of existing solutions - the inability to effectively detect Medium Access Control (MAC) address spoofing. We calculate the clock skew of an AP from the IEEE 802.11 Time Synchronization Function (TSF) time stamps sent out in the beacon/probe response frames. We use two different methods for this purpose - one based on linear programming and the other based on least-square fit. We supplement these methods with a heuristic for differentiating original packets from those sent by the fake APs. We collect TSF time stamp data from several APs in three different residential settings. Using our measurement data as well as data obtained from a large conference setting, we find that clock skews remain consistent over time for the same AP but vary significantly across APs. Furthermore, we improve the resolution of received time stamp of the frames and show that with this enhancement, our methodology can find clock skews very quickly, using 50-100 packets in most of the cases. We also discuss and quantify the impact of various external factors including temperature variation, virtualization, clock source selection, and NTP synchronization on clock skews. Our results indicate that the use of clock skews appears to be an efficient and robust method for detecting fake APs in wireless local area networks.

Nowadays, wireless LAN has become the most widely deployed technology in mobile devices for providing Internet access. As a result, WLAN users usually find themselves covered by multiple access points and have to decide which one to associate with. In traditional implementations, most wireless stations would select the access point with the strongest signal, regardless of traffic load on that access point, which might result in heavy congestion and unfair load. In this paper, we propose a novel on-line association algorithm to deal with any sequence of STAs during a long-term time such as one day.