93
Wireless NeTWOrKs by Ananth Ravindran Assistant Professor

wireless networks ppt

Embed Size (px)

DESCRIPTION

ec

Citation preview

Page 1: wireless networks ppt

Wireless NeTWOrKs

by

Ananth RavindranAssistant Professor

Page 2: wireless networks ppt

UNiT i

MUlTiPle rADiO ACCess

Medium Access Alternatives: Fixed-Assignment for Voice

Oriented Networks Random Access for Data Oriented Networks ,

Handoff and Roaming Support, Security and Privacy

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 3: wireless networks ppt

WIRELESS MEDIUM ACCESS

ALTERNATIVES

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 4: wireless networks ppt

WIRELESS MEDIUM ACCESS

1. Fixed-Assignment Access for Voice-Oriented Networks

a. Frequency Division Multiple Access (FDMA)

b. Time Division Multiple Access (TDMA)

c. Code-Division Multiple Access (CDMA)

2. Random Access for Data-Oriented Networks

a. ALOHA-Based Wireless Random Access Techniques

b. CSMA-Based Wireless Random Access Techniques

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 5: wireless networks ppt

Fixed-Assignment Multiple Access

TechniquesEC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 6: wireless networks ppt

• The available spectrum bandwidth for our wireless

communication is limited.

• Multiple access techniques enable multiple signals to

occupy a single communications channel.

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 7: wireless networks ppt

Major Types

• Frequency division multiple access (FDMA)

• Time division multiple access (TDMA)

• Code division multiple access (CDMA)

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 8: wireless networks ppt

Frequency Division Multiple Access

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 9: wireless networks ppt

Frequency Division Multiple Access

• It assigns individual frequency to individual users.

(i.e ) accommodates one user at a time.

• Each user is separated by Guard Bands.

• The complexity of FDMA mobile systems is lower when

compared to TDMA systems

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 10: wireless networks ppt

• A guardband is a narrow frequency band betweenadjacent frequency channels to avoid interferencefrom the adjacent channels

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 11: wireless networks ppt

• The number of channels that can be simultaneouslysupported in a FDMA system is given by

• BT -> total spectrum allocation,

• BGUARD -> the guard band

• BC -> the channel bandwidth

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 12: wireless networks ppt

Key Features

• If an FDMA channel is not in use, then it sits idle and

cannot be used by other users

• The bandwidths of FDMA channels are narrow (30

kHz)

• Intersymbol interference is low

• It needs only a few synchronization bits

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 13: wireless networks ppt

De Merits• FDMA systems are costlier because of the single channel per

carrier design,

• It need to use costly bandpass filters to eliminate spurious

radiation at the base station.

• The FDMA mobile unit uses duplexers since both the

transmitter and receiver operate at the same time. This

results in an increase in the cost of FDMA subscriber units and

base stations.

• FDMA requires tight RF filtering to minimize adjacent channel

interference.EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 14: wireless networks ppt

Time Division Multiple Access

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 15: wireless networks ppt

Time division multiple access

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 16: wireless networks ppt

TDMA vs FDMA

TDMA FDMA

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 17: wireless networks ppt

• Time division multiple access (TDMA) systems divide the radio

spectrum into time slots

• Each user occupies a cyclically repeat-ing time slot

• A set of ‘N’ slots form a Frame.

• Each frame is made up of a preamble, an information

message, and tail bits

• TDMA systems transmit data in a buffer-and-burst method

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 18: wireless networks ppt

• TDMA shares a single carrier frequency with several

users, where each user makes use of non-

overlapping time slots

• TDMA uses different time slots for transmission and

reception

• Adaptive equalization is usually necessary in TDMA

systems, since the transmission rates are generally

very high as compared to FDMA channelsEC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 19: wireless networks ppt

• High synchronization overhead is required in

TDMA systems because of burst transmissions

• Guard Bands are necessary to ensure that

users at the edge of the band do not "bleed

over" into an adjacent radio service.

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 20: wireless networks ppt

Frame Structure

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 21: wireless networks ppt

• The preamble contains the address and

synchronization information that both the

base station and the subscribers use to

identify each other.

• Trial bits specify the start of a data.

• Synchronization bits will intimate the receiver

about the data transfer.

• Guard Bits are used for data isolation.EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 22: wireless networks ppt

Efficiency of TDMA

• The efficiency of a TDMA system is a measure

of the percentage of transmitted data that

contains information as opposed to providing

overhead for the access scheme

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 23: wireless networks ppt

whereb0H – no over head bits per framebr - no of overhead bits per bp - no overhead bits per preamble in each slotbg - no equivalent bits in each guard time intervalNr - reference bursts per frame, Nt- traffic bursts per frame

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 24: wireless networks ppt

• The total number of bits per frame, bT, is

bT = TfR

• Tf is the frame duration, and R is the channel bit rate

• Then the frame efficiency is

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 25: wireless networks ppt

• And the no of frames

m - maximum number of TDMA users supported on each radio channel

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 26: wireless networks ppt

Spread spectrum multiple access (SSMA)

• Frequency Hopped Multiple Access (FHMA)

• Direct Sequence Multiple Access (DSMA)

Direct sequence multiple access is also called code division

multiple access (CDMA).

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 27: wireless networks ppt

Frequency Hopped Multiple Access

• The carrier frequencies of the individual users

are varied in a pseudorandom fashion within a

wideband channel

• The digital data is broken into uniform sized

bursts which are transmitted on different

carrier frequenciesEC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 28: wireless networks ppt

• Fast Frequency Hopping System -> the rate of

change of the carrier frequency is greater than

the symbol rate

• Slow Frequency Hopping -> the channel

changes at a rate less than or equal to the

symbol rate

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 29: wireless networks ppt

Code Division Multiple Access (CDMA)

• The narrowband message signal is multiplied by a

very large bandwidth signal called the spreading

signal (pseudo-noise code)

• The chip rate of the pseudo-noise code is much

more than message signal.

• Each user has its own pseudorandom codeword.

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 30: wireless networks ppt

Message

PN sequence

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 31: wireless networks ppt

• CDMA uses CO-Channel Cells

• All the users use the same carrier frequency and may

transmit simultaneously without any knowledge of

others.

• The receiver performs a time correlation operation

to detect only the specific desired codeword.

• All other code words appear as noise

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 32: wireless networks ppt

• Multipath fading may be substantially reduced

because the signal is spread over a large spectrum

• Channel data rates are very high in CDMA systems

• CDMA supports Soft handoff MSC can

simultaneously monitor a particular user from two or

more base stations. The MSC may chose the best

version of the signal at any time without switching

frequencies.

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 33: wireless networks ppt

• In CDMA, the power of multiple users at a receiver

determines the noise floor.

• In CDMA, stronger received signal levels raise the

noise floor at the base station demodulators for the

weaker signals, thereby decreasing the probability

that weaker signals will be received. This is called

Near- Far problem.

• To combat the Near- Far problem, power control is

used in most CDMAEC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 34: wireless networks ppt

Random Access for Data-Oriented Networks

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 35: wireless networks ppt

Random Access for Data-Oriented Networks

• In all wireless networks such as cellular telephony or PCSservices all voice-oriented operations use fixed-assignmentchannel access.

• And data related traffic is carried out using Random AccessTechniques.

• Random access methods provide a more flexible and efficientway of managing channel access for communicating shortbursty messages.

• It provides each user station with varying degrees of freedomin gaining access to the network whenever information is tobe sent. EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 36: wireless networks ppt

ALOHA-Based Wireless Random Access Techniques

• The original ALOHA protocol is also called pure ALOHA.

• ALOHA Protocol is developed by University of Hawaii. The

word ALOHA means "hello" in Hawaiian.

• The initial system used ground-based UHF radios to connect

computers on several of the island campuses with the

university's main computer center on Oahu, by use of a

random access protocol which has since been known as the

ALOHA protocolEC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 37: wireless networks ppt

Basic Concept • A mobile terminal transmits an information packet when the packet

arrives from the upper layers of the protocol stack.

• A user accesses a channel as soon as a message is ready to be

transmitted.

• Each packet is encoded with an error-detection code.

• After a transmission, the user waits for an acknowledgment on

either the same channel or a separate feedback channel.

• The BS checks the parity of the received packet. If the parity checks

properly, the BS sends a short acknowledgment packet to the MS.EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 38: wireless networks ppt

Collision

• The message packets are transmitted at arbitrary times, so there is

a possibility of collisions between packets.

• After sending a packet the user waits a length of time more than

the round-trip delay for an acknowledgment from the receiver.

• If no acknowledgment is received, the packet is assumed lost in a

collision, and it is transmitted again with a randomly selected delay

to avoid repeated collisions.

• As the number of users increase, a greater delay occurs because the

probability of collision increasesEC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 39: wireless networks ppt

Pure ALOHA

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 40: wireless networks ppt

Merits :• The advantage of ALOHA protocol is that it is very

simple, and it does not impose any synchronization

between mobile terminals

De-Merits:• Its has low throughput under heavy load conditions.

• The maximum throughput of the pure ALOHA is 18

percent. EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 41: wireless networks ppt

Slotted ALOHA• The maximum throughput of a slotted ALOHA is 36 percent.

• In slotted ALOHA, time is divided into equal time slots of

length greater than the packet duration t.

• The subscribers have synchronized clocks and each user will

be synchronized with the BS clock.

• The user message packet is buffered and transmitted only at

the beginning of a new time slot. This prevents partial

collisions. EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 42: wireless networks ppt

New transmissions are started only at the beginning of new slot EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 43: wireless networks ppt

Application;

• In GSM the initial contact between BS and MS for

voice communication is carried out by slotted

ALOHA.

De-Merit;

• Even though the throughput is higher than pure

ALOHA it is still low for present day wireless

communication needs.EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 44: wireless networks ppt

Reservation ALOHA

• Reservation ALOHA is the combination of slotted ALOHA and

time division multiplexing.

• In this certain packet slots are assigned with priority, and it is

possible for users to reserve slots for the transmission of

packets.

• For high traffic conditions, reservations on request offers

better throughput.EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 45: wireless networks ppt

Packet Reservation Multiple Access (PRMA)

• PRMA is a method for transmitting a variable mixture of voice

packets and data packets.

• This allows each time slot to carry either voice or data, where

voice is given priority.

• PRMA merges characteristics of slotted ALOHA and TDMA

protocols.

• It is used for short-range voice transmission where a small

delay is acceptable.

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 46: wireless networks ppt

• The transmission format in PRMA is organized into frames,

each containing a fixed number of time slots.

• Each slot as named as either "reserved" or "available“

• Only the user terminal that reserved the slot can use a

reserved slot.

• Other terminals not holding a reservation can use an

‘available’ slot.

• Terminals can send two types of information, referred to as

periodic and random.

• Speech packets are always periodic. Data packets can be

random. EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 47: wireless networks ppt

Reservation ;

• A terminal having periodic information to send starts

transmitting in contention for the next available time slot.

• After completion of transmission the base station grants the

sending terminal a reservation for exclusive use of the same

time slot in the next frame.

• This frame is reserved till the terminal completes its

transmission.

• The reservation status is reverted when the terminal sends

nothing in that frameEC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 48: wireless networks ppt

CSMA-Based Wireless Random Access

Techniques

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 49: wireless networks ppt

De-Merits of ALOHA

1. ALOHA protocols do not listen to the channel before

transmission, the users will start transmitting as

soon as the message is ready.

2. Efficiency is reduced by the collision and

retransmission process.

3. There are no mechanisms to avoid collisions.EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 50: wireless networks ppt

CSMA- Carrier Sense Multiple Access

• In this each terminal will monitor the status of the channel before

transmitting information.

• If there is another user transmitting on the channel, it is obvious

that a terminal should delay the transmission of the packet.

• If the channel is idle, then the user is allowed to transmit data

packet without any restrictions.

• The CSMA protocol reduces the packet collision significantly

compared with ALOHA protocol. But not eliminate entirely.EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 51: wireless networks ppt

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 52: wireless networks ppt

Parameters in CSMA protocols

1. Detection delay - is a function of the receiver

hardware and is the time required for a terminal to

sense whether or not the channel is idle

2. Propagation delay- is a relative measure of how fast

it takes for a packet to travel from a base station to

a mobile terminal.EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 53: wireless networks ppt

• Propagation delay is important, since just after a user begins

sending a packet, another user may be ready to send and may

be sensing the channel at the same time.

• If the transmitting packet has not reached the user who is

poised to send, the latter user will sense an idle channel and

will also send its packet, resulting in a collision between the

two packets.

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 54: wireless networks ppt

Propagation delay (td)

where

• tp -> propagation time in seconds,

• Rb -> channel bit rate

• m -> expected number of bits in a data packet EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 55: wireless networks ppt

Various strategies of the CSMA

1. NON-PERSISTENT CSMA — In this type of CSMA strategy, afterreceiving a negative acknowledgment the terminal waits arandom time before retrans-mission of the packet.

2. 1-PERSISTENT CSMA — The terminal senses the channel andwaits for transmission until it finds the channel idle. As soonas the channel is idle, the terminal transmits its messagewith probability one.

3. p-PERSISTENT CSMA —When a channel is found to be idle,the packet is transmitted with probability p . It may or maynot be immediate.EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 56: wireless networks ppt

4. CSMA/CD – In this the user monitors the channel for possible

collisions. If two or more terminals start a transmission at the

same time the transmission is immediately aborted in midway.

5. Data sense multiple access (DSMA) - is a special type of CSMA

that is used to serve the hidden terminals. Cellular networks uses

different frequencies for forward and reverse channel. Each MS

may not have the knowledge about other MS operating in that

area. So it may not know when the channel is idle. For this the BS

can announce the availability of the reverse channel through the

forward control channel. The BS uses Busy-Idle bit to announce.EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 57: wireless networks ppt

6. Busy tone multiple access (BTMA)- this is a special type of

technique where the system bandwidth is divided into

message channel and busy channel. Whenever a terminal

sends data through message channel it will also transmits a

busy-tone in busy channel. If another terminal senses the

busy channel it will understand that the message channel is

busy and it will also turns its busy tone. This acts as an alarm

for other terminals.

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 58: wireless networks ppt

Handoff

• Process of transferring a moving active user

from one base station to another without

disrupting the call.

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 59: wireless networks ppt

Handoff Strategies

1. Ist generation handoff2. MAHO (Mobile Assisted HandOff)3. Inter system handoff4. Guard channel concept5. Queuing 6. Umbrella approach7. Soft and hard handoff8. Cell dragging.EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 60: wireless networks ppt

Ist generation handoff-

• In this almost all the work were carried out by

MSC with the help of Base Station.

• Using the Locator Receiver the MSC will measure

the signal strength of the moving mobile.

• If the level decreases it will perform handoff by

its own.

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 61: wireless networks ppt

MAHO (Mobile Assisted HandOff)

• In this every mobile station measures the received power

from surrounding base stations and continually reports the

results of these measurements to the serving base station.

• When the power received from the base station of a

neighboring cell begins to exceed the power received from

the current base station by a certain level or for a certain

period of time a handoff is initiated.

• Since all the measurements were done by the mobile, the

load of the MSC is reduced considerablyEC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 62: wireless networks ppt

• Inter system handoff -occurs if a mobile moves from

one cellular system to a different cellular system

controlled by a different MSC (service provider) or

while roaming

• Guard channel concept – In this some channels are

reserved only for handoff.

• Queuing – If more number of users request handoff the

they will be placed in queue before allotting channels

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 63: wireless networks ppt

Umbrella approach

• Speed of the user is a main factor in deciding a

successful handoff.

• In urban areas the cell size will be very small and high

speed users will cross quickly.

• To perform handoff on these high speed users we

use Micro and Macro cells concurrently.EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 64: wireless networks ppt

Umbrella approach

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 65: wireless networks ppt

Cell dragging

• Cell dragging occurs in an urban environment when

there is a line-of-sight (LOS) radio path between the

pedestrian subscriber and the base station.

• Even after the user has traveled well beyond the

designed range of the cell, the received signal at the

base station does not decay rapidly resulting in Cell

DraggingEC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 66: wireless networks ppt

Soft and hard handoff

• Hard handoff- when the user moves to a new cell, he

will be assigned with a new set of channels.

• Soft Handoff- when the user moves to a new cell, the

channel itself will be switched to the new base

station. CDMA uses soft Handoff.

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 67: wireless networks ppt

WIRELESS SECURITY AND

PRIVACY

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 68: wireless networks ppt

• The broadcast nature of wireless communications

renders it very susceptible to malicious interception and

wanted or unintentional interference.

• Analog techniques are extremely easy to tap.

• Digital systems such as TDMA and CDMA are much

harder to tap.

• Wireless security is necessary to prevent the

unauthorized access or damage to computers

using wireless networks.EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 69: wireless networks ppt

There are two names you need to know in a wireless

network:

• Station (STA) -> is a wireless network client—a desktop

computer, laptop, or PDA

• Access point (AP)-> is the central point (like a hub) that

creates a basic service set to bridge a number of STAs

from the wireless network to other existing networks.EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 70: wireless networks ppt

Modes of unauthorized access

1. Accidental association2. Malicious association3. Ad-hoc networks4. Non-traditional networks5. Identity theft (MAC spoofing)6. Man-in-the-middle attacks7. Denial of service8. Network injection9. Caffe Latte attack

http://en.wikipedia.org/wiki/Wireless_securityEC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 71: wireless networks ppt

1. Accidental association

– Violation of security perimeter of corporate

network unintentionally.

2. Malicious association

– when wireless devices can be actively made by attackers to

connect to a company network through their cracking company

access point (AP).

– These types of laptops are known as “soft APs” and are created

when a cyber criminal runs some software that makes his/her

wireless network card look like a legitimate access point.

– Once access is gained, he/she can steal passwords, launch

attacks on the wired network, or plant TrojansEC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 72: wireless networks ppt

3. Ad-hoc networks

– Ad-hoc networks are defined as peer-to-peer networks

between wireless computers that do not have an access point

in between them. While these types of networks usually have

little protection, encryption methods can be used to provide

security.

4. Non-traditional networks

– Non-traditional networks such as personal

network Bluetooth devices are not safe from cracking and

should be regarded as a security risk. Even barcode readers,

handheld PDAs, and wireless printers and copiers should be

secured EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 73: wireless networks ppt

5. Identity theft (MAC spoofing)

– Identity theft occurs when a cracker is able to listen

in on network traffic and identify the MAC address of

a computer with network privileges.

6. Man-in-the-middle attacks

– In this the hacker will include a soft AP in to a

network. Once this is done, the hacker connects to a

real access point through another wireless card

offering a steady flow of traffic through the

transparent hacking computer to the real networkEC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 74: wireless networks ppt

7. Denial of service

– A Denial-of-Service attack (DoS) occurs when an

attacker continually bombards a targeted Access

Point or network with bogus requests, premature

successful connection messages, failure messages,

and other commands.

– These cause legitimate users to not be able to get

on the network and may even cause the network

to crashEC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 75: wireless networks ppt

8. Network injection

– In a network injection attack, a cracker can make use

of access points that are exposed to non-filtered

network traffic.

– The cracker injects bogus networking re-configuration

commands that affect routers, switches, and

intelligent hubs.

– A whole network can be brought down in this manner

and require rebooting or even reprogramming of all

intelligent networking devicesEC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 76: wireless networks ppt

9. Caffe Latte attack

– The Caffe Latte attack is another way to defeat WEP.

– It is not necessary for the attacker to be in the area of

the network using this exploit.

– By using a process that targets the Windows wireless stack,

it is possible to obtain the WEP key from a remote client

– By sending a flood of encrypted Address Resolution

Protocol (ARP) requests, the assailant takes advantage of

the shared key authentication and the message

modification flaws in WEP.EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 77: wireless networks ppt

The Attack Methodology

1. Footprint the wireless network- Locate and understand

your target.

2. Passive attack - Analyze the network traffic or break the

WEP.

3. Authentication and authorization - Determine what

methods are enforced and how they can be circumvented.

4. Active attack - Launch denial of service (DoS) attacks.

http://technet.microsoft.com/en-us/library/bb457019.aspxEC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 78: wireless networks ppt

Defense Mechanisms

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 79: wireless networks ppt

• Wired Equivalent Privacy (WEP)

• Wi-Fi Protected Access (WPA)

• Wi-Fi Protected Access- 2 (WPA-2)

• ……. EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 80: wireless networks ppt

Wired Equivalent Privacy (WEP)

• WEP is a standard network protocol that adds security to

wireless networks at the data link layer.

• WEP utilizes a data encryption scheme called RC4 for

data protection.

• RC4 (also known as ARC4 or ARCFOUR ) is the most

widely used software stream cipher and is used in

popular protocols.EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 81: wireless networks ppt

• RC4 generates a pseudorandom stream of bits.

• Standard 64-bit WEP uses a 40 bit key (WEP-40) and

a 24 bit initialization vector .

• 128-bit WEP protocol using a 104-bit key size (WEP-

104) and a 24 bit initialization vector.

• Initialization vector (IV) is a fixed-size input which is

used for randomization of key. The purpose of an IV

is to prevent any repetition.EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 82: wireless networks ppt

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 83: wireless networks ppt

Authentication1. The client sends an authentication request to the

Access Point.

2. The Access Point replies with a clear-text challenge.

3. The client encrypts the challenge-text using the

configured WEP key, and sends it back in another

authentication request.

4. The Access Point decrypts the response. If this matches

the challenge-text the Access Point sends back a

positive reply.EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 84: wireless networks ppt

Dis Advantages

• The same traffic key must never be used twice.

• But a 24-bit IV is not long enough to ensure this on a busy network.

• In August 2001, Scott Fluhrer, Itsik Mantin, and Adi

Shamir published a cryptanalysis of WEP that decodes the way the

RC4 cipher and IV is used in WEP.

• Using a passive attack they were able to recover the RC4key after

eavesdropping on the network.

• A successful key recovery could take as little as one minute

depending on the traffic.

• WEP is replaced by WPA(Wi-Fi Protected Access)EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 85: wireless networks ppt

Wi-Fi Protected Access(WPA)

• The Wi-Fi Alliance intended WPA as an

intermediate measure to take the place of

WEP.

• WPA uses Temporal Key Integrity Protocol

(TKIP) to bolster encryption of wireless

packets.EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 86: wireless networks ppt

Wi-Fi Protected Access(WPA)

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 87: wireless networks ppt

TKIP

• TKIP encryption replaces WEP's 40-bit or 104-bit

encryption key that must be manually entered on

wireless access points and devices and does not change

• TKIP uses a 128-bit per-packet key, it dynamically

generates a new key for each packet and prevents

collisions

• It has an extended initialization vector (IV) with

sequencing rules, and a re-keying mechanism.EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 88: wireless networks ppt

WPA with TKIP provides 3 levels of security

1. TKIP implements a key mixing function that

combines the secret root key with the initialization

vector before passing it to the RC4 initialization.

2. WPA implements a sequence counter to protect

against replay attacks. Packets received out of order

will be rejected by the access point.

3. TKIP implements a 64-bit Message Integrity Check

(MIC)EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 89: wireless networks ppt

Merits and Demerits

• TKIP uses the same underlying mechanism as WEP,and consequently is vulnerable to a number ofsimilar attacks.

• But the message integrity check, per-packet keyhashing, broadcast key rotation, and a sequencecounter prevents many attacks.

• The key mixing function also eliminates the WEP keyrecovery attacks

• Beck-Tews attack has successfully extracted thekeystream EC2043 W

IRELESS N

ETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 90: wireless networks ppt

Ohigashi-Morii attack

• Japanese researchers Toshihiro Ohigashi andMasakatu Morii reported a simpler and fasterimplementation of a similar attack.

• It utilizes a similar attack method, but usesa man-in-the-middle attack

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 91: wireless networks ppt

WPA 2

• WPA2 (Wireless Protected Access 2) replaced the

original WPA technology on all certified Wi-Fi hardware

since 2006.

• WPA2 uses Pre-Shared Key (PSK) instead of TKIP

• WPA2 Pre-Shared Key (PSK) utilizes keys with 256 bits

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 92: wireless networks ppt

There are two versions of WPA2

1. WPA2-Personal- protects unauthorized

network access by utilizing a set-up password

2. WPA2-Enterprise- verifies network users

through a server. WPA2 is backward

compatible with WPA.EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R

Page 93: wireless networks ppt

EC2043 WIR

ELESS NETWORKS

Visit www.agniece.blog.com for further details Ananth.R