See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/277560716

A Survey on Wireless Security: Technical Challenges, Recent Advances and

Future Trends

Article in Proceedings of the IEEE · May 2015

DOI: 10.1109/JPROC.2016.2558521 · Source: arXiv

CITATIONS READS
1,088 4,669

3 authors:

Yulong Zou Xianbin Wang

37 PUBLICATIONS 3,725 CITATIONS

The University of Western Ontario
620 PUBLICATIONS 14,942 CITATIONS
SEE PROFILE
SEE PROFILE

L. Hanzo
University of Southampton
3,020 PUBLICATIONS 73,112 CITATIONS

SEE PROFILE

All content following this page was uploaded by L. Hanzo on 18 July 2019.

The user has requested enhancement of the downloaded file.

 PROCEEDINGS OF THE IEEE 1

A Survey on Wireless Security: Technical

Challenges, Recent Advances and Future Trends
Yulong Zou, Senior Member, IEEE, Xianbin Wang, Senior Member, IEEE, and Lajos Hanzo, Fellow, IEEE

Abstract—Due to the broadcast nature of radio propagation, AKA Authentication and Key Agreement
the wireless air interface is open and accessible to both authorized AP Access Point
arXiv:1505.07919v1 [cs.IT] 29 May 2015

and illegitimate users. This completely differs from a wired BS Base Station
network, where communicating devices are physically connected
through cables and a node without direct association is unable CDMA Code Division Multiple Access
to access the network for illicit activities. The open communica- CK(s) Ciphering Key(s)
tions environment makes wireless transmissions more vulnerable CSI Channel State Information
than wired communications to malicious attacks, including both CSMA/CA Carrier Sense Multiple Access with Collision
the passive eavesdropping for data interception and the ac- Avoidance
tive jamming for disrupting legitimate transmissions. Therefore,
this paper is motivated to examine the security vulnerabilities CST Carrier Sensing Time
and threats imposed by the inherent open nature of wireless CTS Clear to Send
communications and to devise efficient defense mechanisms for DA Destination Address
improving the wireless network security. We first summarize DCF Distributed Coordination Function
the security requirements of wireless networks, including their DES Data Encryption Standard
authenticity, confidentiality, integrity and availability issues. Next,
a comprehensive overview of security attacks encountered in DIFS Distributed Inter-Frame Space
wireless networks is presented in view of the network protocol DN Destination Node
architecture, where the potential security threats are discussed DSSS Direct-Sequence Spread Spectrum
at each protocol layer. We also provide a survey of the exist- DoS Denial of Service
ing security protocols and algorithms that are adopted in the EPC Evolved Packet Core
existing wireless network standards, such as the Bluetooth, Wi-
Fi, WiMAX, and the long-term evolution (LTE) systems. Then, E-UTRAN Evolved-Universal Terrestrial Radio Access Net-
we discuss the state-of-the-art in physical-layer security, which work
is an emerging technique of securing the open communica- FHSS Frequency-Hopping Spread Spectrum
tions environment against eavesdropping attacks at the physical FTP File Transfer Protocol
layer. Several physical-layer security techniques are reviewed GSVD Generalized Singular Value Decomposition
and compared, including information-theoretic security, artificial
noise aided security, security-oriented beamforming, diversity HSS Home Subscriber Server
assisted security, and physical-layer key generation approaches. HTTP HyperText Transfer Protocol
Additionally, since a jammer emitting radio signals can readily ICMP Internet Control Message Protocol
interfere with the legitimate wireless users, we introduce the ICV Integrity Check Value
family of various jamming attacks and their counter-measures, IK(s) Integrity Key(s)
including the constant jammer, intermittent jammer, reactive
jammer, adaptive jammer and intelligent jammer. Finally, some IMSI International Mobile Subscriber Identity
technical challenges which remain unresolved at the time of IP Internet Protocol
writing are summarized and the future trends in wireless security IV Initialization Vector
are discussed. LTE Long Term Evolution
Index Terms—Wireless security, eavesdropping attack, denial- MAC Medium Access Control
of-service (DoS), jamming, network protocol, information- MIC Message Integrity Check
theoretic security, artificial noise, beamforming, diversity, wire- MIMO Multiple-Input Multiple-Output
less jamming, wireless networks.
MISOME Multiple-Input Single-Output Multiple-
Eavesdropper
NOMENCLATURE MITM Man In The Middle
3G 3rd Generation MME Mobility Management Entity
AAA Authentication, Authorization and Accounting NIC Network Interface Controller
AES Advanced Encryption Standard NP Non-deterministic Polynomial
OFDMA Orthogonal Frequency-Division Multiple Access
Y. Zou is with the School of Telecommunications and Information Engineer- OSI Open Systems Interconnection
ing, Nanjing University of Posts and Telecommunications, Nanjing, China.
email: {[email protected]}. PER Packet Error Rate
X. Wang is with the Electrical and Computer Engineering Depart- PKM Privacy and Key Management
ment, The University of Western Ontario, London, Ontario, Canada. email: PN Pseudo Noise
{[email protected]}.
L. Hanzo is with the School of Electronics and Computer Science, Univer- PRNG Pseudo-Random Number Generator
sity of Southampton, Southampton, UK. email: {[email protected]}. QoS Quality of Service
PROCEEDINGS OF THE IEEE 2

Channel
RFCOMM Radio Frequency COMMunications characteristics
RSA Rivest-Shamir-Adleman Secrecy
capacity Authentication
RSS Received Signal Strength
RTS Request to Send
SA Source Address Wireless
Intercept
SIFS Short Inter-Frame Space probability
Security Authorization
SINR Signal-to-Interference-and-Noise Ratio Design
SQL Structured Query Language
SMTP Simple Mail Transfer Protocol
SN Source Node Complexity Encryption
SNR Signal-to-Noise Ratio Latency
SS Subscriber Station
Fig. 1. Wireless security methodologies and design factors.
SSL Secure Sockets Layer
TA Transmitter Address
TCP Transmission Control Protocol
TDMA Time-Division Multiple Access application layer, transport layer, network layer [6], medium
TK Temporal Key access control (MAC) layer [7] and physical layer [8], [9].
TKIP Temporal Key Integrity Protocol Security threats and vulnerabilities associated with these pro-
TLS Transport Layer Security tocol layers are typically protected separately at each layer
TSC TKIP Sequence Counter to meet the security requirements, including the authenticity,
TTAK TKIP-mixed Transmit Address and Key confidentiality, integrity and availability [10]. For example,
TTLS Tunneled Transport Layer Security cryptography is widely used for protecting the confidentiality
UDP User Datagram Protocol of data transmission by preventing information disclosure to
UE(s) User Equipment(s) unauthorized users [11], [12]. Although cryptography im-
UMTS Universal Mobile Telecommunications System proves the achievable communications confidentiality, it re-
WEP Wired Equivalent Privacy quires additional computational power and imposes latency
WiMAX Worldwide Interoperability for Microwave Ac- [13], since a certain amount of time is required for both
cess data encryption and decryption [14]. In order to guarantee
WLAN Wireless Local Area Network the authenticity of a caller or receiver, existing wireless
WMAN Wireless Metropolitan Area Network networks typically employ multiple authentication approaches
WPA Wi-Fi Protected Access simultaneously at different protocol layers, including MAC-
WPA2 Wi-Fi Protected Access II layer authentication [15], network-layer authentication [16],
WPAN Wireless Personal Area Network [17] and transport-layer authentication [18]. To be specific,
in the MAC layer, the MAC address of a user should be
authenticated to prevent unauthorized access. In the network
I. I NTRODUCTION layer, the Wi-Fi protected access (WPA) and the Wi-Fi pro-
tected access II (WPA2) are two commonly used network-
D URING the past decades, wireless communications in-
frastructure and services have been proliferating with
the goal of meeting rapidly increasing demands [1], [2].
layer authentication protocols [19], [20]. Additionally, the
transport-layer authentication includes the secure socket layer
According to the latest statistics released by the International (SSL) and its successor, namely the transport layer security
Telecommunications Union in 2013 [3], the number of mobile (TLS) protocols [21]-[23]. It becomes obvious that exploiting
subscribers has reached 6.8 billion worldwide and almost multiple authentication mechanisms at different protocol layers
40% of the world’s population is now using the Internet. is capable of enhancing the wireless security, again, at the
Meanwhile, it has been reported in [4] that an increasing cost of high computational complexity and latency. As shown
number of wireless devices are abused for illicit cyber-criminal in Fig. 1, the main wireless security methodologies include
activities, including malicious attacks, computer hacking, data the authentication, authorization and encryption, for which the
forging, financial information theft, online bullying/stalking diverse design factors e.g. the security level, implementation
and so on. This causes the direct loss of about 83 billion Euros complexity and communication latency need to be balanced.
with an estimated 556 million users worldwide impacted by In wired networks, the communicating nodes are physically
cyber-crime each year, according to the 2012 Norton cyber- connected through cables. By contrast, wireless networks are
crime report [4]. Hence, it is of paramount importance to extremely vulnerable owing to the broadcast nature of the
improve wireless communications security to fight against wireless medium. Explicitly, wireless networks are prone to
cyber-criminal activities, especially because more and more malicious attacks, including eavesdropping attack [24], denial-
people are using wireless networks (e.g., cellular networks and of-service (DoS) attack [25], spoofing attack [26], man-in-
Wi-Fi) for online banking and personal emails, owing to the the-middle (MITM) attack [27], message falsification/injection
widespread use of smartphones. attack [28], etc. For example, an unauthorized node in a
Wireless networks generally adopt the open systems in- wireless network is capable of inflicting intentional interfer-
terconnection (OSI) protocol architecture [5] comprising the ences with the objective of disrupting data communications
PROCEEDINGS OF THE IEEE 3

between legitimate users. Furthermore, wireless communica- physical-layer secret key generation techniques. Additionally,
tions sessions may be readily overheard by an eavesdropper, we provide a review on various wireless jammers (i.e., the
as long as the eavesdropper is within the transmit coverage constant jammer, intermittent jammer, reactive jammer, adap-
area of the transmitting node. In order to maintain confidential tive jammer and intelligent jammer) as well as their detection
transmission, existing systems typically employ cryptographic and prevention techniques. Finally, we outline some of open
techniques for preventing eavesdroppers from intercepting data challenges in wireless security.
transmissions between legitimate users [29], [30]. However, The remainder of this paper is organized as follows. Section
cryptographic techniques assume that the eavesdropper has II presents the security requirements of wireless networks,
limited computing power and rely upon the computational where the authenticity, confidentiality, integrity and avail-
hardness of their underlying mathematical problems. Hence, ability of wireless services are discussed. In Section III,
they can only achieve what we may refer to as computational we analyze the security vulnerabilities and weaknesses of
security. The security of a cryptographic approach would be wireless networks at different protocol layers, including the
significantly compromised, if an efficient method of solving application layer, transport layer, network layer, MAC layer
its underlying hard mathematical problem was to be dis- and physical layer. Next, in Section IV, the security protocols
covered [31]. More importantly, the conventional secret key and algorithms used in existing wireless networks, such as the
exchange in cryptographic techniques (e.g., Diffie-Hellman Bluetooth, Wi-Fi, WiMAX and LTE standards, are discussed.
key agreement protocol) requires a trusted key management Then, Section V presents the physical-layer security which is
center, which however may not be applicable in some wireless emerging as an effective paradigm conceived for improving
networks operating without a fixed infrastructure due to the the security of wireless communications against eavesdrop-
highly dynamic nature of mobile environments [32], [149]- ping attacks by exploiting the physical-layer characteristics
[151]. of wireless channels. Additionally, we summarize the various
To this end, physical-layer security is emerging as a promis- known wireless jamming attacks and their counter-measures
ing means of protecting wireless communications to achieve in Section VI, followed by Section VII, where some open
information-theoretic security against eavesdropping attacks. challenges and future trends in wireless security are presented.
In [33], Wyner examined a discrete memoryless wiretap Finally, Section VIII provides some concluding remarks.
channel consisting of a source, a destination as well as an
eavesdropper and proved that perfectly secure transmission can II. S ECURITY R EQUIREMENTS IN W IRELESS N ETWORKS
be achieved, provided that the channel capacity of the main
link from the source to the destination is higher than that of Again, in wireless networks, the information is exchanged
the wiretap link from the source to the eavesdropper. In [34], among authorized users, but this process is vulnerable to
Wyner’s results were extended from the discrete memoryless various malicious threats owing to the broadcast nature of
wiretap channel to the Gaussian wiretap channel, where the the wireless medium. The security requirements of wireless
notion of a so-called secrecy capacity was developed, which networks are specified for the sake of protecting the wireless
was shown to be equal to the difference between the channel transmissions against wireless attacks, such as eavesdropping
capacity of the main link and that of the wiretap link. If attack, DoS attack, data falsification attack, node compromise
the secrecy capacity falls below zero, the transmissions from attack and so on [44], [45]. For example, maintaining data
the source to the destination become insecure and the eaves- confidentiality is a typical security requirement, which refers
dropper would become capable of intercepting the source’s to the capability of restricting data access to authorized users
transmissions [35], [36]. In order to improve the attainable only, while preventing eavesdroppers from intercepting the
transmission security, it is of importance to increase the information. Generally speaking, secure wireless communica-
secrecy capacity by exploiting sophisticated signal processing tions should satisfy the requirements of authenticity, confiden-
techniques, such as the artificial noise aided security [37]-[39], tiality, integrity and availability [46], as detailed below:
security-oriented beamforming [40], [41], security-oriented • Authenticity: Authenticity refers to confirming the true

diversity approaches [42], [43] and so on. identity of a network node to distinguish authorized users
In this paper, we are motivated to discuss diverse wireless at- from unauthorized users. In wireless networks, a pair
tacks as well as the corresponding defense mechanisms and to of communicating nodes should first perform mutual
explore a range of challenging open issues in wireless security authentication before establishing a communications link
research. The main contributions of this paper are summarized for data transmission [47]. Typically, a network node
as follows. Firstly, a systematic review of security threats and is equipped with a wireless network interface card and
vulnerabilities is presented at the different protocol layers, has a unique medium access control (MAC) address,
commencing from the physical layer up to the application which can be used for authentication purposes. Again, in
layer. Secondly, we summarize the family of security protocols addition to MAC authentication, there are other wireless
and algorithms used in the existing wireless networks, such as authentication methods, including network-layer authen-
the Bluetooth, Wi-Fi, WiMAX and long-term evolution (LTE) tication, transport-layer authentication and application-
standards. Thirdly, we discuss the emerging physical-layer layer authentication.
security in wireless communications and highlight the class • Confidentiality: The confidentiality refers to limiting the
of information-theoretic security, artificial noise aided security, data access to intended users only, while preventing the
security-oriented beamforming, security-oriented diversity and disclosure of the information to unauthorized entities
PROCEEDINGS OF THE IEEE 4

TABLE I
[48]. Considering the symmetric key encryption tech- S UMMARIZATION OF W IRELESS S ECURITY R EQUIREMENTS .
nique as an example, the source node first encrypts the
original data (often termed as plain-text) using an encryp-
tion algorithm with the aid of a secret key that is shared Security Requirements Specific Objectives to be Achieved

with the intended destination only. Next, the encrypted Specified to differentiate authorized users from
Authenticity
plain-text (referred to as cipher-text) is transmitted to unauthorized users
the destination that then decrypts its received cipher- Confidentiality
Specified to limit the confidential data access to
intended users only
text using the secret key. Since the eavesdropper has no
Specified to guarantee the accuracy of the trans-
knowledge of the secret key, it is unable to interpret the Integrity
mitted information without any falsification
plain-text based on the overheard cipher-text. However, Specified to make sure that the authorized users
the classic Diffie-Hellman key agreement protocol used Availability can access wireless network resources anytime
in symmetric key cryptography is only computationally and anywhere upon request

secure [31] and requires a trusted key management center,

which may not be applicable in some wireless networks
operating without a fixed infrastructure [32], [149]-[151]. ploys a pseudo-noise (PN) sequence to spread the spec-
To this end, physical-layer security emerges as an effec- trum of the original signal to a wide frequency bandwidth.
tive means of protecting the confidentiality of wireless In this way, the jamming attack operating without the
transmission against eavesdropping attacks for achieving knowledge of the PN sequence has to dissipate a much
information-theoretic security [33], [49]. The details of higher power for disrupting the legitimate transmission,
physical-layer security will be discussed in Section V. which may not be feasible in practice due to its realistic
• Integrity: The integrity of information transmitted in a power constraint. As an alternative, FHSS continuously
wireless network should be accurate and reliable during changes the central frequency of the transmitted wave-
its entire life-cycle representing the source-information form using a certain frequency-hopping pattern, so that
without any falsification and modification by unautho- the jamming attacker cannot monitor and interrupt the
rized users. The data integrity may be violated by so- legitimate transmissions.
called insider attacks, such as for example node com- The above-mentioned authenticity, confidentiality, integrity
promise attacks [50]-[52]. More specifically, a legitimate and availability are summarized in Table I, which are com-
node that is altered and compromised by an adversary, monly considered and implemented in the existing wireless
is termed as a compromised node. The compromised networks, including the Bluetooth [58], Wi-Fi [59], Worldwide
node may inflict damage upon the data integrity by Interoperability for Microwave Access (WiMAX) [60], Long-
launching malicious attacks, including message injection, Term Evolution (LTE) [61] standards and so on. In principle,
false reporting, data modification and so on. In general, it wireless networks should be as secure as wired networks. This
is quiet challenging to detect the attacks by compromised implies that the security requirements of wireless networks
nodes, since these compromised nodes running malicious should be the same as those of wired networks, including
codes still have valid identities. A promising solution to the requirements of authenticity, confidentiality, integrity and
detect compromised nodes is to utilize the automatic code availability. However, due to the broadcast nature of radio
update and recovery process, which guarantees that the propagation, achieving these security requirements in wireless
nodes are periodically patched and a compromised node networks is more challenging than in wired networks. For
may be detected, if the patch fails. The compromised example, the availability of wireless networks is extremely
nodes can be repaired and revoked through the so-called vulnerable, since a jamming attack imposing a radio signal can
code recovery process. readily disrupt and block the wireless physical-layer communi-
cations. Hence, compared to wired networks, wireless systems
• Availability: The availability implies that the authorized
typically employ an additional DSSS (or FHSS) technique in
users are indeed capable of accessing a wireless network
order to protect the wireless transmissions against jamming
anytime and anywhere upon request. The violation of
attacks.
availability, referred to as denial of service, will result
in the authorized users to become unable to access the
wireless network, which in turn results in unsatisfactory III. S ECURITY V ULNERABILITIES IN W IRELESS
user experience [53], [54]. For example, any unauthorized N ETWORKS
node is capable of launching DoS activities at the physical In this section, we present a systematic review of various
layer by maliciously generating interferences for dis- security vulnerabilities and weaknesses encountered in wire-
rupting the desired communications between legitimate less networks. Apart from their differences, wired and wireless
users, which is also known as a jamming attack. In order networks also share some similarities. For example, they both
to combat jamming attacks, existing wireless systems adopt the OSI layered protocol architecture consisting of the
typically consider the employment of spread spectrum physical layer, MAC layer, network layer, transport layer
techniques, including direct-sequence spread spectrum and application layer. As shown in Fig. 2, a network node
(DSSS) [55], [56] and frequency-hopping spread spec- (denoted by node A) employs these protocols for transmitting
trum (FHSS) solutions [57]. To be specific, DSSS em- its data packets to another network node (i.e., node B).
PROCEEDINGS OF THE IEEE 5

Node A Node B

Application Application

Transport Transport

Network Network

Medium Access Control Medium Access Control

(MAC) (MAC)

Physical (PHY) Physical (PHY)

Wireless Medium

Fig. 2. A generic wireless OSI layered protocol architecture consisting of the application layer, transport layer, network layer, MAC layer and physical layer.

TABLE II
M AIN P ROTOCOLS AND S PECIFICATIONS OF THE W IRELESS OSI L AYERS .

Wired Common Wireless

attacks attacks attacks OSI Layers Main Protocols and Specifications

Application HTTP, FTP, SMTP [62]

Transport TCP, UDP [63], [64]

Fig. 3. Relationship between the wired and wireless attacks.
Network IP, ICMP [65]

MAC CSMA/CA, ALOHA, CDMA [66], OFDMA [67]

To be specific, the data packet at node A is first extended PHY Transmission Medium, Coding and Modulation
with the protocol overheads, including the application-layer
overhead, transport-layer overhead, network-layer overhead,
MAC overhead and physical-layer overhead. This results in
an encapsulated packet. Then, the resultant data packet is transfer protocol (FTP) is used for large-file-transfer, and the
transmitted via the wireless medium to node B, which will simple mail transfer protocol (SMTP) is invoked for electronic
perform packet-decapsulation, commencing from the physical mail (e-mail) transmission and so on [62]. The commonly
layer and proceeding upward to the application layer, in order used transport-layer protocols include the transport control
to recover the original data packet. Note that the difference protocol (TCP) and the user datagram protocol (UDP) [63],
between the wired and wireless networks mainly lies in the [64]. The TCP ensures the reliable and ordered delivery of data
PHY and MAC layers, while the application, transport and packets, whereas UDP has no guarantee of such reliable and
network layers of wireless networks are typically identical to ordered delivery. In contrast to TCP, UDP has no handshaking
those of wired networks. As a consequence, the wired and dialogues and adopts a simpler transmission model, hence
wireless networks share some common security vulnerabilities imposing a reduced protocol overhead. In the network layer,
owing to their identical application, transport and network we also have different protocols, such as the Internet protocol
layers. Nevertheless, they also suffer from mutually exclusive (IP), which was conceived for delivering data packets based
attacks due to the fact that the wired and wireless networks on IP addresses, and the Internet control message protocol
have different PHY and MAC layers, as shown in Fig. 3. (ICMP) designed for sending error messages for indicating,
Table II shows the main protocols and specifications im- for example, that a requested service is unavailable or that
plemented at each of wireless OSI layers. For example, a network node could not be reached [65]. Regarding the
the application-layer supports the hypertext transfer protocol MAC layer, there are numerous different protocols adopted
(HTTP) for the sake of delivering web services, while the file by various wireless networks, such as the carrier sense mul-
PROCEEDINGS OF THE IEEE 6

TABLE III TABLE IV

M AIN T YPES OF W IRELESS ATTACKS AT THE PHY L AYER . M AIN T YPES OF W IRELESS ATTACKS AT THE MAC L AYER .

PHY Attacks Characteristics and Features MAC Attacks Characteristics and Features

Eavesdropping Interception of confidential information [71] MAC spoofing Falsification of MAC address [73]

Jamming Interruption of legitimate transmission [72] Identity theft Stealing of a legitimate user's MAC identity

MITM attack Impersonation of a pair of communicating nodes [74]

Network injection Injection of forged network commands and packets [75]

tiple access with collision avoidance (CSMA/CA) used in
Wi-Fi networks, the slotted ALOHA employed in tactical
satellite networks by military forces, code division multiple
access (CDMA) involved in third-generation (3G) mobile net- defending against DoS attacks by spreading the transmit signal
works [66] and orthogonal frequency-division multiple access over a wider spectral bandwidth than its original frequency
(OFDMA) adopted in the long term evolution (LTE) and band. Again, the above-mentioned DSSS and FHSS techniques
LTE-advanced networks [67]. Additionally, the physical layer exhibit a high jamming-resistance at the physical layer.
specifies the physical characteristics of information transmis-
sion, including the transmission medium, modulation, line B. MAC-Layer Attacks
coding, multiplexing, circuit switching, pulse shaping, forward The MAC layer enables multiple network nodes to access
error correction, bit-interleaving and other channel coding a shared medium with the aid of intelligent channel access
operations, etc. control mechanisms such as CSMA/CA, CDMA, OFDMA
Every OSI layer has its own unique security challenges and so on. Typically, each network node is equipped with a
and issues, since different layers rely on different protocols, network interface controller (NIC) and has a unique MAC
hence exhibiting different security vulnerabilities [68]-[70]. address, which is used for user authentication. An attacker
Below we summarize the range of wireless attacks potentially that attempts to change its assigned MAC address with a
encountered by various protocol layers. malicious intention is termed as MAC spoofing, which is the
primary technique of MAC attacks [73]. Although the MAC
A. Physical-Layer Attacks address is hard-coded into the NIC of a network node, it is
The physical layer is the lowest layer in the OSI proto- still possible for a network node to spoof a MAC address
col architecture, which is used for specifying the physical and thus MAC spoofing enables the malicious node to hide
characteristics of signal transmission. Again, the broadcast its true identity or to impersonate another network node for
nature of wireless communications makes its physical layer the sake of carrying out illicit activities. Furthermore, a MAC
extremely vulnerable to eavesdropping and jamming attacks, attacker may overhear the network traffic and steal a legitimate
which are two main types of wireless physical-layer attacks, node’s MAC address by analyzing the overheard traffic, which
as depicted in Table III. More specifically, the eavesdropping is referred to as an identity-theft attack. An attacker attempting
attack refers to an unauthorized user attempting to intercept the identity theft will pretend to be another legitimate network
data transmission between legitimate users [71]. In wireless node and gain access to confidential information of the victim
networks, as long as an eavesdropper lies in the transmit node.
coverage area of the source node, the wireless communica- In addition to the above-mentioned MAC spoofing and
tions session can be overheard by the eavesdropper. In order identity theft, the class of MAC-layer attacks also includes
to maintain confidential transmission, typically cryptographic MITM attacks [74] and network injection [75]. Typically,
techniques relying on secret keys are adopted for preventing a MITM attack refers to an attacker that first ‘sniffs’ the
eavesdropping attacks from intercepting the data transmission. network’s traffic in order to intercept the MAC addresses of a
To be specific, the source node (SN) and destination node (DN) pair of legitimate communicating nodes, then impersonates the
share a secret key and the so-called plain-text is first encrypted two victims and finally establishes a connection with them. In
at SN, leading to the cipher-text, which is then transmitted to this way, the MITM attacker acts as a relay between the pair
DN. In this case, even if an eavesdropper overhears the cipher- of victims and makes them feel that they are communicating
text transmission, it remains difficult to extract the plain-text directly with each other over a private connection. In reality,
from the cipher-text without the secret key. their session was intercepted and controlled by the attacker.
Moreover, a malicious node in wireless networks can read- By contrast, the network injection attack aims for preventing
ily generate intentional interference for disrupting the data the operation of networking devices, such as routers, switches,
communications between legitimate users, which is referred etc. by injecting forged network re-configuration commands.
to as a jamming attack (also known as DoS attack) [72]. The In this manner, if an overwhelming number of the forged
jammer aims for preventing authorized users from accessing networking commands are initiated, the entire network may
wireless network resources and this impairs the network avail- become paralyzed, thus requiring rebooting or even repro-
ability for the legitimate users. To this end, spread spectrum gramming of all networking devices. The main types of
techniques are widely recognized as an effective means of wireless MAC attacks are summarized in Table IV.
PROCEEDINGS OF THE IEEE 7

TABLE V TABLE VI
M AIN T YPES OF W IRELESS ATTACKS AT THE N ETWORK L AYER . M AIN T YPES OF W IRELESS ATTACKS AT THE T RANSPORT L AYER .

Network Attacks Characteristics and Features Transport Attacks Characteristics and Features

IP spoofing Falsification of IP address [76] TCP flooding Sending a huge number of ping requests [80], [81]

IP hijacking Impersonation of a legitimate user’s IP address [77], [78] UDP flooding Launching an overwhelming number of UDP packets [82]

Paralyzation of a network by launching a huge number TCP sequence Fabrication of a legitimate user’s data packets using the
Smurf attack
of ICMP requests [79] prediction attack predicted TCP sequence index

C. Network-Layer Attacks
In the network layer, IP was designed as the principal and for transferring files from one network node to another.
protocol for delivering packets from a SN to a DN through In contrast to TCP, UDP is a connectionless transport protocol
intermediate routers based on their IP addresses. The network- associated with a reduced protocol overhead and latency, but
layer attacks mainly aim for exploiting IP weaknesses, which as a price, it fails to guarantee reliable data delivery. It is often
include the IP spoofing and hijacking as well as the so-called used by delay-sensitive applications which do not impose strict
Smurf attack [76]-[78], as illustrated in Table V. To be specific, reliability requirements, such as IP television, voice over IP
IP spoofing is used for generating a forged IP address with the and online games. Both TCP and UDP suffer from security
goal of hiding the true identity of the attacker or impersonating vulnerabilities including the TCP and UDP flooding as well as
another network node for carrying out illicit activities. The the TCP sequence number prediction attacks, as summarized
network node that receives these packets associated with a in Table VI.
forged source IP address will send its responses back to TCP attacks include TCP flooding attacks and sequence
the forged IP address. This will waste significant network number prediction attacks [80], [81]. The TCP flooding, which
capacity and might even paralyze the network by flooding it is also known as ping flooding, is a DoS attack in the transport
with forged IP packets. IP hijacking is another illegitimate layer, where the attacker sends an overwhelming number of
activity launched by hijackers for the sake of taking over ping requests, such as ICMP echo requests to a victim node,
another legitimate user’s IP address. If the attacker succeeds which then responds by sending ping replies, such as ICMP
in hijacking the IP address, it will be able to disconnect the echo replies. This will flood both the input and output buffers
legitimate user and create a new connection to the network of the victim node and it might even delay its connection
by impersonating the legitimate user, hence gaining access to to the target network, when the number of ping requests is
confidential information. There are some other forms of IP hi- sufficiently high. The TCP sequence prediction technique is
jacking techniques, including prefix hijacking, route hijacking another TCP attack that attempts to predict the sequence index
and border gateway protocol hijacking [78]. of TCP packets of a transmitting node and then fabricates the
The Smurf attack is a DoS attack in the network layer, TCP packets of the node. To be specific, the TCP sequence
which intends to send a huge number of ICMP packets (with prediction attacker first guesses the TCP sequence index of a
a spoofed source IP address) to a victim node or to a group of victim transmitter, then fabricates packets using the predicted
victims using an IP broadcast address [79]. Upon receiving the TCP index, and finally sends its fabricated packets to a victim
ICMP requests, the victims are required to send back ICMP receiver. Naturally, the TCP sequence prediction attack will
responses, resulting in a significant amount of traffic in the inflict damage upon the data integrity owing to the above-
victim network. When the Smurf attack launches a sufficiently mentioned packet fabrication and injection.
high number of ICMP requests, the victim network will
become overwhelmed and paralyzed by these ICMP requests The UDP is also prone to flooding attacks, which are
and responses. To defend against Smurf attacks, a possible imposed by sending an overwhelming number of UDP pack-
solution is to configure the individual users and routers by ets, instead of ping requests used in the TCP flood attack.
ensuring that they do not to constantly respond to ICMP Specifically, a UDP flood attacker transmits a large number
requests. We may also consider the employment of firewalls, of UDP packets to a victim node, which will be forced to
which can reject the malicious packets arriving from the forged send numerous reply packets [82]. In this way, the victim
source IP addresses. node will be overwhelmed by the malicious UDP packets and
becomes unreachable by other legitimate nodes. Moreover, the
UDP flooding attacker is capable of hiding itself from the
D. Transport-Layer Attacks legitimate nodes by using a spoofed IP address for generating
This subsection briefly summarizes the malicious activities malicious UDP packets. The negative impact of such UDP
in the transport layer, with an emphasis on the TCP and UDP flooding attacks is mitigated by limiting the response rate
attacks. To be specific, TCP is a connection-oriented transport of UDP packets. Furthermore, firewalls can be employed for
protocol designed for supporting the reliable transmission of defending against the UDP flooding attacks for filtering out
data packets, which is typically used for delivering e-mails malicious UDP packets.
PROCEEDINGS OF THE IEEE 8

TABLE VII Wireless Attacks Wired Attacks

M AIN T YPES OF W IRELESS ATTACKS AT THE A PPLICATION L AYER . Comparison
Application attacks same Application attacks

Application Attacks Characteristics and Features Transport attacks same Transport attacks

Network attacks same Network attacks

Malicious software in the form of code, scripts and
Malware attack
active content programmed by attackers [85] MAC attacks different MAC attacks
Inserting rogue SQL statements attempting to gain
SQL injection PHY attacks different PHY attacks
unauthorized access to legitimate websites
Injecting client-side scripts into web pages for by-
Cross-site scripting
passing some of the access control measures
Fig. 4. Comparison between the wireless and wired networks in terms of
Impersonating a legtimate user to gain unauthorized security attacks at different OSI layers.
FTP bounce
access [83]
Malicious attacks in e-mail transfering between the
SMTP attack
SMTP servers and clients
e-mails are frequent carriers of viruses and worms. Thus, the
SMTP attacks include the password ‘sniffing’, SMTP viruses
and worms as well as e-mail spoofing [84]. Typically, antivirus
software or firewalls (or both) are adopted for identifying and
E. Application-Layer Attacks guarding against the aforementioned application-layer attacks.
As mentioned above, the application layer supports HTTP Table VII summarizes the aforementioned main attacks at the
[62] for web services, FTP [83] for file transfer and SMTP application layer.
[84] for e-mail transmission. Each of these protocols is prone Finally, we summarize the similarities and differences be-
to security attacks. Logically, the application-layer attacks tween the wireless and wired networks in terms of their
may hence be classified as HTTP attacks, FTP attacks and security attacks at the different OSI layers. As shown in Fig. 4,
SMTP attacks. More specifically, HTTP is the application the application, transport and network-layer attacks of wireless
protocol designed for exchanging hypertext across the World networks are the same as those of wired networks, since the
Wide Web, which is subject to numerous security threats. The wireless and wired networks share common protocols at the
main HTTP attacks include the Malware attack (e.g., Trojan application, transport and network layers. By contrast, wireless
horse, viruses, worms, backdoors, keyloggers, etc.), structured networks are different from wired networks in terms of the
query language (SQL) injection attack and cross-site scripting PHY and MAC attacks. In general, only the PHY and MAC
attack [85]. The terminology Malware refers to malicious layers are specified in wireless networking standards (e.g., Wi-
software which is in the form of code, scripts and active Fi, Bluetooth, LTE, etc.). In wireless networks, conventional
content programmed by attackers attempting to disrupt legit- security protocols are defined at the MAC layer (sometimes
imate transmissions or to intercept confidential information. at the logical-link-control layer) for establishing a trusted
The SQL injection is usually exploited to attack data-driven and confidential link, which will be summarized for different
applications by inserting certain rogue SQL statements with commercial wireless networks in Section IV. Additionally, the
an attempt to gain unauthorized access to legitimate websites. wireless PHY layer is completely different from its wireline
The last type of HTTP attacks to be mentioned is referred based counterpart. Due to the broadcast nature of radio propa-
to as cross-site scripting attacks that typically occur in web gation, the wireless PHY layer is extremely vulnerable to both
applications and aim for bypassing some of the access control the eavesdropping and jamming attacks. To this end, physical-
measures (e.g., the same-origin-policy) by injecting client-side layer security is emerging as an effective means of securing
scripts into web pages [85]. wireless communications against eavesdropping, as it will be
The FTP is used for large-file transfer from one network discussed in Section V. Next, Section VI will present various
node to another, which also exhibits certain security vulnera- wireless jamming attacks and their counter-measures.
bilities. The FTP bounce attacks and directory traversal attacks
often occur in FTP applications [83]. The FTP bounce attack IV. S ECURITY D EFENSE P ROTOCOLS AND PARADIGMS
exploits the PORT command in order to request access to FOR W IRELESS N ETWORKS
ports through another victim node, acting as a middle-man. This section is focused on the family of security protocols
We note however that most modern FTP servers are configured and paradigms that are used for improving the security of
by default to refuse PORT commands in order to prevent FTP wireless networks. As compared to wired networks, the wire-
bounce attacks. The directory traversal attack attempts to gain less networks have the advantage of avoiding the deployment
unauthorized access to legitimate file systems by exploiting of a costly cable based infrastructure. The stylized illustration
any potential security vulnerability during the validation of of operational wireless networks is shown in Fig. 5, where
user-supplied input file names. In contrast to FTP, the SMTP is the family of wireless personal area networks (WPAN), wire-
an application-layer protocol designed for transferring e-mails less local area networks (WLAN) and wireless metropolitan
across the Internet, which, however, does not encrypt private area networks (WMAN) are illustrated, which complement
information, such as the login username, the password and the each other with the goal of providing users with ubiquitous
messages themselves transmitted between the SMTP servers broadband wireless services [86]. The objective of Fig. 5 is
and clients, hence raising a serious privacy concern. Moreover, to provide a comparison amongst the WPAN, WLAN and
PROCEEDINGS OF THE IEEE 9

Network type
User Interface
WMAN
General
Application Application Application Managament
Entity
WLAN
RFCOMM
Security Service
(or other multiplexing protocol)
Manager Database
WPAN
Coverage area

Peak data rate

150Mb/s
100km

L2CAP

2Mb/s
Device

1Gb/s
250m

100m
Database

Bluetooth HCI

Link Manager/Controller
Wi-Fi

Query Registration

WiMAX, LTE RFCOMM: Radio Frequency Communication

L2CAP: Logical Link Control and Adaptation Protocol
Industrial standards
HCI: Host Controller Interface

Fig. 5. A family of wireless networks consisting of the wireless personal

area network (WPAN), wireless local area network (WLAN) and wireless Fig. 6. Bluetooth security architecture.
metropolitan area network (WMAN).

protocols for guaranteeing its transmissions against potentially

WMAN techniques from different perspectives in terms of serious attacks [91]. For security reasons, each Bluetooth
their industrial standards, coverage area and peak data rates. device has four entities [92], including the Bluetooth device
More specifically, a WPAN is typically used for interconnect- address (BD ADDR), private authentication key, private en-
ing with personal devices (e.g., a keyboard, audio headset, cryption key and a random number (RAND), which are used
printer, etc.) at a relatively low data rate and within a small for authentication, authorization and encryption, respectively.
coverage area. For example, Bluetooth is a common WPAN More specifically, the BD ADDR contains 48 bits, which
standard using short-range radio coverage in the industrial, is unique for each Bluetooth device. The 128-bit private
scientific and medical band spanning the band 2400-2480MHz, authentication key is used for authentication and the private
which can provide a peak data rate of 2Mbs and a range of encryption key that varies from 8 to 128 bits in length is used
up to 100 meters (m) [87]. Fig. 5 also shows that a WLAN for encryption. In addition, RAND is a frequently changing
generally has a higher data rate and a wider coverage area 128-bit pseudo-random number generated by the Bluetooth
than the WPAN, which is used for connecting wireless devices device itself.
through an access point (AP) within a local coverage area. As Fig. 6 illustrates the Bluetooth security architecture, where
an example, IEEE 802.11 (also known as Wi-Fi) consists of a the key component is the security manager responsible for
series of industrial WLAN standards. Modern Wi-Fi standards authentication, authorization and encryption [91]. As shown
are capable of supporting a peak data rate of 150Mbs and a in Fig. 6, the service database and device database are mainly
maximum range of 250m [88]. Finally, a MAN is typically used for storing the security-related information on services
used for connecting a metropolitian city at a higher rate and and devices, respectively, which can be adjusted through the
over a lager coverage area than the WPAN and WLAN. For user interface. These databases can also be administrated by
instance, in Fig. 5, we feature two types of industrial standards the general management entity. When a Bluetooth device
for WMAN, namely WiMAX and LTE [89], [90]. receives an access request from another device, it will first
In the following, we will present an overview of the security query its security manager with the aid of its radio frequency
protocols used in the aforementioned wireless standards (i.e., communications (RFCOMM) or other multiplexing protocols.
the Bluetooth, Wi-Fi, WiMAX and LTE) for protecting the Then, the security manager has to respond to the query as to
authenticity, confidentiality, integrity and availability of legiti- whether to allow the access or not by checking both the service
mate transmissions through the wireless propagation medium. database and device database. The generic access profile of
Bluetooth defines three security modes:
(I) security mode 1 (non-secure), where no security proce-
A. Bluetooth dure is initiated;
Bluetooth is a short-range and low-power wireless network- (II) security mode 2 (service-level enforced security), where
ing standard, which has been widely implemented in com- the security procedure is initiated after establishing a link
puting and communications devices as well as in peripherals, between the Bluetooth transmitter and receiver;
such as cell phones, keyboards, audio headsets, etc. However, (III) security mode 3 (link level enforced security), where
Bluetooth devices are subject to a large number of wireless the security procedure is initiated before the link’s establish-
security threats and may easily become compromised. As a ment [91].
protection, Bluetooth introduces diverse security features and In Bluetooth systems, a device is classified into one