We introduce the key reinstallation attack. This attack abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key. This resets the key's associated parameters such as transmit nonces and receive replay counters. Several types of cryptographic Wi-Fi handshakes are affected by the attack. All protected Wi-Fi networks use the 4-way handshake to generate a fresh session key. So far, this 14-year-old handshake has remained free from attacks, and is even proven secure. However, we show that the 4-way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value. Our key reinstallation attack also breaks the PeerKey, group key, and Fast BSS Transition (FT) handshake. The impact depends on the handshake being attacked, and the data-confidentiality protocol in use. Simplified, against AES-CCMP an adversary can replay and decrypt (but not forge) packets. This makes it possible to hijack TCP streams and inject malicious data into them. Against WPA-TKIP and GCMP the impact is catastrophic: packets can be replayed, decrypted, and forged. Because GCMP uses the same authentication key in both communication directions, it is especially affected. Finally, we confirmed our findings in practice, and found that every Wi-Fi device is vulnerable to some variant of our attacks. Notably, our attack is exceptionally devastating against Android 6.0: it forces the client into using a predictable all-zero encryption key.

/pdf/key-reinstallation-attacks-forcing-nonce-reuse-in-wpa2-tcuksgp69s.pdf

Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2

Seamless handover process is essential in order to provide efficient communication between mobile nodes in wireless local area networks. Despite the importance of a signal strength prediction model to provide seamless handovers, it is not embedded in standard mobility management protocols. In this article, we propose a smart handover prediction system based on curve fitting model to perform the handover CHP algorithm. The received signal strength indicator parameter, from scanning phase, is considered as an input to the CHP in order to provide a prediction technique for a mobile node to estimate the received signal strength value for the access points in the neighborhood and to select the best candidate access point from them in an intelligent way. We implemented the proposed approach and compared it with standard protocols and linear regression-based handover prediction approach. Simulation results in complex wireless environments show that our CHP approach performs the best by predicting the received signal strength value with up to 800ms in advance from real obtained value via scanning phase. Moreover, our CHP approach is the best in terms of layer2 and overall handover latency, in comparison with standard protocols and linear regression approach, respectively. Copyright © 2012 John Wiley & Sons, Ltd.

A smart handover prediction system based on curve fitting model for Fast Mobile IPv6 in wireless networks

The functionality of mobile devices has grown exponentially in recent times. This has led to smart phones and the mobile Internet becoming a big success story. IEEE 802.11 wireless local area network, known as Wi-Fi, has become a standard feature on these devices and represents a viable alternative to using a mobile phone provider?s network for connectivity. Users can surf the web, make VoIP calls, and more from their home WLAN networks or public hotspots. At present WLAN has too many outstanding issues to universally replace existing mobile phone networks. However, WLAN is ready to provide universal coverage for mobile devices in large controlled environments such as university and business campuses, sports stadia, and entertainment parks. In this article we outline the challenges in such a deployment and describe how the state of the art in WLAN can meet these challenges. Outstanding issues and areas requiring improvement are highlighted. With a view to overcoming these hurdles, some potential solutions and promising research directions are outlined.

http://www.eeng.dcu.ie/~munteang/papers/2010_COMMAG_48_12_KC.pdf

Supporting mobile devices with wireless LAN/MAN in large controlled environments

Ethanol: A Software-Defined Wireless Networking architecture for IEEE 802.11 networks

Orchestration of heterogeneous wireless networks: State of the art and remaining challenges

Handover performance is critical to support multimedia services that are becoming increasingly available over the wireless devices. The high transition delay can be unaccepted for such services or can be a source of disruption on the session. On the other side, IEEE 802.11 standard is being extended with new functionalities. Security and QoS features, included in recent IEEE 802.11-2007 standard, add management frames that are exchanged during the transition process. In consequence the handover delay is increased. IEEE 802.11r-2008 amendment introduces Fast BSS Transition (FT) that simplifies the handover process. The authors propose the new handover algorithms based on FT protocol and compare them with existing solution. Additionally, simulation experiments are conducted to answer the question if multimedia services can be properly supported in IEEE 802.11r networks. The authors prove that handover delay can be reduced to 13 ms in the average case.

/pdf/on-the-fast-bss-transition-algorithms-in-the-ieee-802-11r-4gncs0nl5y.pdf

On the fast BSS transition algorithms in the IEEE 802.11r local area wireless networks

Handover performance in wireless networks is important, especially nowadays, when multimedia services are becoming increasingly available over the wireless devices. However, users expect uncompromised mobility when using the service. Thus, the support of multimedia services is not possible if handover is inefficient. At the same time it is clear that a strict separation between IP Layer and the Link Layer results in built-in sources of delay. The paper discusses the IEEE 802.11 and Mobile IPv4 handover performance in practical scenarios. We introduce a new simultaneous handover scheme with IEEE 802.21 triggers. In order to verify the handover performance, simulation experiments have been conducted, whose results are also presented and discussed.

Simultaneous handover scheme for IEEE 802.11 WLANs with IEEE 802.21 triggers

A rapid growth of IP-based networks and services created the vast collection of resources and functionality available to users by means of an uniform method of access – an IP protocol. At the same time, advances in design of mobile electronic devices allowed them to reach utility level comparable to stationary, desktop computers, while still retaining their mobility advantage. Unfortunately, the base IP protocol does not perform very well in mobile environments, due to lack of handover support and higher layer mobility management mechanisms. In this paper we present an overview of the most popular and promising methods of handling mobility in IPv4 and IPv6 networks, covering both ISO-OSI layer 2 low level handover mechanisms in IEEE 802.11 WLAN systems and ISO-OSI layer 3+ mobility solutions.

Comparative Analysis of IP-Based Mobility Protocols and Fast Handover Algorithms in IEEE 802.11 Based WLANs

The handover performance is critical to support multimedia services in the wireless networks. The algorithm should allow fast selection of the most suitable Access Point. However, in most solutions the handover is reactive and causes Mobile Station to reassociate with the Access Point that offers the strongest received strength signal at a time. The station may miss the chance to handover to the Access Point that offers better traffic conditions until the current association is maintained. In the paper the novel Proactive Handover Algorithm is proposed that incorporates 802.11k measurements for better characterization of the access point. Moreover, the protocol is proactive and allows reassociation with the best Access Point at a time. Finally, the handover delay is limited to 3 milliseconds excluding time required to switch the channel. The results were proved via simulation experiments.

Proactive handover for IEEE 802.11r networks

Multimedia services are becoming increasingly available over the wireless devices. Handover performance has a direct impact on user satisfaction from such services. The high transition delay can be unaccepted for the multimedia application or can be a source of disruption on the session. On the other side, IEEE 802.11 standard is being extended with new functionalities. Security and QoS features, included in recent IEEE 802.11-2007 standard, add management frames that are exchanged during the transition process. In consequence the handover delay is increased. IEEE 802.11r-2008 amendment introduces Fast BSS transition (FT) that simplifies the handover process. The authors propose the new handover algorithms based on FT protocol and compare them with existing algorithm. Additionally, simulation experiments are conducted to answer the question if multimedia services can be properly supported in IEEE 802.11r networks. The authors prove that handover delay can be reduced to 22 ms in the average case.

P. Machań

Papers

On the fast BSS transition algorithms in the IEEE 802.11r local area wireless networks

Simultaneous handover scheme for IEEE 802.11 WLANs with IEEE 802.21 triggers

Comparative Analysis of IP-Based Mobility Protocols and Fast Handover Algorithms in IEEE 802.11 Based WLANs

Proactive handover for IEEE 802.11r networks

Performance evaluation of IEEE 802.11 fast BSS transition algorithms