Mobile and Wireless Security (CY-803 (A)) - Unit 4 Short Notes

I. Wireless Access Technologies

A. Wireless Personal Area Networks (WPAN)

• Definition: Short-range wireless networks for interconnecting devices within a personal workspace (typically < 10 meters).

• Distinguishing Characteristics:

  • Range: Very short (1–10 m) vs. WLAN (∼100 m), WMAN (∼5 km), WWAN (kilometers).

  • Power Consumption: Very low, enabling battery-powered operation.

  • Data Rate: Low to moderate (Bluetooth: 1–3 Mbps; Zigbee: 250 kbps).

  • Topology: Typically star or peer-to-peer (piconet for Bluetooth).

• Key Technologies:

  • Bluetooth: Frequency-hopping spread spectrum (FHSS) in 2.4 GHz ISM band; forms piconets (1 master, ≤7 slaves).

  • Zigbee: Based on IEEE 802.15.4; low-power, low-data-rate, supports mesh topologies; used in IoT/automation.

  • IrDA: Infrared line-of-sight communication; obsolete for general use but in legacy devices (remote controls).

• Use Cases: Peripheral connectivity (keyboard, mouse), smart home sensors, wearable device sync.

[!TIP] Exam often asks to compare WPAN with WLAN/WMAN/WWAN. Use a table for clarity.

B. Wireless Local Area Networks (WLAN)

• Evolution of Wi-Fi Standards (IEEE 802.11):

  | Standard | Year | Frequency | Max Data Rate | Key Feature | |----------|------|-----------|---------------|-------------| | 802.11b | 1999 | 2.4 GHz | 11 Mbps | DSSS, legacy | | 802.11a | 1999 | 5 GHz | 54 Mbps | OFDM, less interference | | 802.11g | 2003 | 2.4 GHz | 54 Mbps | OFDM backward compatible with b | | 802.11n | 2009 | 2.4/5 GHz | 600 Mbps | MIMO, channel bonding | | 802.11ac | 2013 | 5 GHz | 3.5 Gbps | MU-MIMO, wider channels (160 MHz) | | 802.11ax | 2019 | 2.4/5/6 GHz | 9.6 Gbps | OFDMA, improved MU-MIMO, efficiency in dense environments |

• Implications on Trends: Shift from single-user to multi-user (MU-MIMO, OFDMA), higher spectral efficiency, operation in 5/6 GHz to avoid congestion, backward compatibility maintained.

• Components:

  • Access Point (AP): Bridge between wired/wireless; broadcasts SSID (network name).

  • Client Stations: Devices connecting to AP.

  • Channels: 2.4 GHz has 14 overlapping channels (1, 6, 11 non-overlapping); 5 GHz has 23 non-overlapping channels.

• Security Evolution:

  • WEP (1999): Broken (RC4 stream cipher, weak IV).

  • WPA (2003): TKIP (temporal key integrity protocol), still vulnerable.

  • WPA2 (2004): AES-CCMP, mandatory for Wi-Fi certification; robust but susceptible to KRACK.

  • WPA3 (2018): SAE (Simultaneous Authentication of Equals) for password security, forward secrecy, 192-bit security suite for enterprise.

C. Wireless Metropolitan Area Networks (WiMAX)

• Physical Layer Architecture: Based on IEEE 802.16; uses OFDM for downlink (base to subscriber) and SC-FDMA (Single-Carrier FDMA) for uplink to reduce peak-to-average power ratio.

• Modulation Techniques:

  • OFDM: Divides channel into subcarriers; robust against multipath; used in downlink.

  • SC-FDMA: Single-carrier transmission with frequency domain equalization; better for mobile uplink due to lower PAPR.

• Frequency Bands:

  • Licensed: 2.3 GHz, 2.5 GHz, 3.5 GHz (long-range, operator-owned).

  • Unlicensed: 5.8 GHz (shorter-range, similar to Wi-Fi).

• Comparison: Competes with LTE; WiMAX is all-IP but less widely deployed; LTE became dominant 4G standard.

D. Cellular Networks (Generational Evolution)

1. GPRS (2.5G)

• Key Features: Introduced packet-switched domain to GSM; "always-on" connectivity; shared channel usage.

• Mobile Data Support: Enabled mobile internet (WAP, email); data rates up to 114 kbps (theoretical).

• Architecture:

  • SGSN (Serving GSN): Routes data within visited network; tracks mobile location.

  • GGSN (Gateway GSN): Interface to external packet networks (Internet); assigns IP addresses.

  • Base stations (BTS/BSC) remain GSM-based.

2. UMTS (3G)

• Overview: Universal Mobile Telecommunications System; first true mobile broadband.

• Key Features: Higher data rates (384 kbps–2 Mbps); supports multimedia (video calls, mobile TV).

• Architecture:

  • UTRAN (UMTS Terrestrial RAN): Consists of Node B (base station) and RNC (Radio Network Controller).

  • Core Network: Circuit-switched (MSC) and packet-switched (SGSN/GGSN) domains.

3. LTE (4G)

• Definition & Objectives: Long-Term Evolution; all-IP, high-speed, low-latency mobile broadband.

• Key Features:

  • OFDMA (downlink) and SC-FDMA (uplink).

  • MIMO (Multiple-Input Multiple-Output) for spatial multiplexing.

  • Flat IP Architecture: No RNC; eNodeB connects directly to core network (EPC).

• Benefits:

  • Throughput: Downlink up to 100 Mbps (mobile), 1 Gbps (stationary).

  • Latency: < 10 ms (air interface).

  • Spectral efficiency: 2–4× that of 3G.

4. 3G vs. 4G Comparison

[!TIP] Exam may ask for "key differences"—focus on air interface, core network, and performance metrics.

II. Specialized Wireless Networks

A. Ad Hoc Networks

• Definition & Characteristics: Infrastructure-less, self-configuring, multi-hop networks; nodes act as routers.

• Routing Protocol Classifications:

  1. Proactive (Table-Driven):

     • Maintain routes to all nodes via periodic updates.

     • DSDV (Destination-Sequenced Distance-Vector): Distance-vector with sequence numbers to avoid loops.

     • OLSR (Optimized Link State Routing): Periodic HELLO/TC messages; uses MPR (Multi-Point Relay) to reduce overhead.

     • Pros: Low latency; Cons: High overhead in large networks.

  2. Reactive (On-Demand):

     • Discover routes only when needed via route discovery (flooding).

     • AODV (Ad hoc On-Demand Distance Vector): Uses RREQ/RREP; maintains routes via sequence numbers and link-layer feedback.

     • DSR (Dynamic Source Routing): Source routing; route cache stores complete paths.

     • Pros: Low overhead in sparse traffic; Cons: High latency during discovery.

  3. Hybrid:

     • ZRP (Zone Routing Protocol): Combines proactive (within local zone) and reactive (between zones).

• Comparison:

  | Protocol | Overhead | Latency | Scalability | |----------|----------|---------|-------------| | DSDV | High | Low | Poor | | AODV | Moderate | High (on demand) | Good | | OLSR | Moderate | Low | Moderate |

B. Mesh Networks

• Multi-Hop Relay Concept: Nodes forward traffic for others, extending coverage beyond single-hop range.

• Significance:

  • Extended Coverage:通过网络中继覆盖盲区.

  • Reliability: Multiple paths; if one fails, traffic rerouted.

  • Self-Healing: Nodes dynamically adjust to node failures/channel conditions.

• Mesh Types:

  • Infrastructure Mesh: Mesh APs form backbone; clients connect to nearest AP.

  • Client Mesh: Clients themselves relay data (e.g., Zigbee mesh).

• Routing: Typically hybrid (e.g., HWMP in 802.11s: proactive for intra-mesh, reactive for inter-mesh).

III. Mobility Management

A. Mobile IP

• Purpose: Enable seamless IP connectivity while moving across networks (layer-3 mobility).

• Basic Operation:

  • Home Agent (HA): Router in home network; tunnels packets to mobile node's current location.

  • Foreign Agent (FA): Router in visited network; provides care-of address (CoA) and forwards tunneled packets.

  • Care-of Address (CoA): Temporary IP address in visited network (via FA or co-located).

  • Tunneling: HA encapsulates packets to CoA; FA decapsulates and delivers to mobile node (MN).

• Mobile IPv4 vs. Mobile IPv6:

  | Feature | Mobile IPv4 | Mobile IPv6 | |---------|-------------|-------------| | Address Size | 32-bit IPv4 | 128-bit IPv6 (scalable) | | Tunneling | IP-in-IP (RFC 2003) or minimal encapsulation | IPv6-in-IPv6 (extension headers) | | Foreign Agent | Required (optional in co-located CoA) | Eliminated; MN uses co-located CoA | | Route Optimization | Optional (via IETF drafts) | Mandatory (via binding updates) | | Security | IPsec optional, often manual | IPsec mandatory (RFC 3776) | | Header Overhead | 20–40 bytes (outer header) | Minimal (extension headers) |

• Encapsulation Headers:

  • IPv4: Original IP header + new outer header (src=HA, dst=CoA); total overhead ∼40 bytes.

  • IPv6: Uses IPv6 Extension Headers (Routing Header Type 2); more flexible, smaller overhead.

  • Comparison: IPv6 more efficient, integrated security, no FA dependency.

[!TIP] "Encapsulation header structure" is a past question—draw the IPv4/IPv6 header addition.

IV. Transport Layer Adaptations

A. TCP over Wireless Networks

• Challenges in Wireless:

  • High Bit Error Rate (BER): Wireless links prone to noise, fading → packet loss not due to congestion.

  • Latency & Jitter: Variable due to handoffs, retransmissions at MAC layer.

  • Handoffs & Route Changes: Temporary disconnections cause TCP timeouts.

  • Asymmetric Bandwidth: Downlink often faster than uplink (e.g., satellite).

• Adaptations & Solutions:

  • TCP Snoop: Local retransmission at base station (loss recovery without invoking TCP congestion control).

  • Split TCP: Proxy at wireless gateway breaks end-to-end connection; separate TCP connections for wired/wireless segments.

  • TCP Westwood+: Estimates available bandwidth from ACK flow; adjusts congestion window on loss → better for wireless losses.

  • Cross-Layer Optimizations: MAC layer informs TCP of channel state (e.g., via ECN marks or explicit notifications).

  • Impact on Congestion Control: Standard TCP (Reno, Cubic) misinterprets wireless loss as congestion → unnecessary window reduction; adaptations aim to distinguish loss types.

V. Security Frameworks and Applications

A. Military Security Models

• Primary Objectives: Confidentiality, Integrity, Availability, Non-Repudiation.

• Hierarchical Command Structures:

  • Role-Based Access Control (RBAC): Access based on role (e.g., commander, analyst); roles inherit privileges within command hierarchy.

  • Chain of Command: Privilege escalation follows rank; no lateral access without authorization.

  • Multilevel Security (MLS): Data classified (e.g., Top Secret, Secret); subjects cleared to specific levels; mandatory access control (MAC) enforced.

B. Mobile Commerce Security

1. E-commerce

• Definition: Buying/selling goods/services over electronic networks (Internet).

• Transformation: 24/7 availability, global reach, reduced costs, personalized marketing, new business models (apps, subscriptions).

• Security Requirements:

  • Authentication: Verify user/merchant identity (digital certificates, 2FA).

  • Privacy: Protect personal/financial data (encryption, anonymization).

  • Non-Repudiation: Prevent denial of transactions (digital signatures).

2. Electronic Payment Systems

• Types:

  • Card-Based: Credit/debit cards (encrypted transmission, tokenization).

  • Digital Wallets: Store payment credentials (Apple Pay, Google Pay); use NFC/tokenization.

  • Mobile Money: Carrier-billed or stored-value (e.g., M-Pesa).

• Facilitation:

  • Encryption: TLS/SSL for data in transit.

  • Tokenization: Replace card numbers with tokens (PCI DSS compliance).

  • Protocols:

    • SET (Secure Electronic Transaction): Dual signature (order/payment info separated); uses PKI.

    • 3-D Secure: Additional authentication step (e.g., Verified by Visa); redirects to issuer page.

    • EMV: Chip-based card standard; dynamic authentication data.

• Challenges: Fraud (phishing, malware), interoperability across systems, user trust (security perceptions).

C. Denial of Service (DoS)

• Definition & Impact: Attack that makes network/service unavailable to legitimate users; causes resource exhaustion (bandwidth, CPU, memory).

• Wireless-Specific Attacks:

  • Physical Layer Jamming: Transmit noise on channel (simple but effective).

  • MAC Layer Exhaustion: e.g., Deauthentication Attacks (spoof deauth frames in 802.11) disconnect clients.

  • Network Layer Flooding: SYN flood, ICMP flood targeting AP/gateway.

• Mitigation Techniques:

  • Frequency Hopping (FHSS): Spread spectrum; harder to jam entire band.

  • Intrusion Detection Systems (IDS): Detect abnormal traffic patterns.

  • Rate Limiting: Cap request rates per client.

  • Authentication: 802.1X to prevent unauthorized associations.

  • Short-Preamble Mitigation: In 802.11, use robust management frame protection (RMF).

VI. Enabling Technologies

A. Radio Frequency Identification (RFID)

• Definition & Components:

  • Tags: Microchip + antenna; store ID/data.

  • Readers: Emit RF signals, receive tag responses.

  • Middleware: Filter/aggregate tag data, interface with applications.

• Principle of Operation:

  • Inductive Coupling (LF/HF, 125–134 kHz / 13.56 MHz): Magnetic field; short range (<1 m); used in access cards, animal tags.

  • Electromagnetic Propagation (UHF, 860–960 MHz): Backscatter communication; longer range (up to 10 m).

    • Backscatter: Tag modulates reflected RF signal from reader; no transmitter in passive tags.

• Data Transmission:

  • Passive Tags: No battery; powered by reader's RF energy; read-only or read-write; shortest range.

  • Active Tags: Battery-powered; transmit own signal; longer range (∼100 m); used for asset tracking.

  • Semi-Passive (Semi-Active): Battery powers chip but communication via backscatter; longer range than passive, longer battery life.

• Protocols:

  • EPCglobal: Supply chain focus; Class 1 Gen 2 UHF standard.

  • ISO/IEC 18000: Generic standards for different frequencies.

• Applications & Security/Privacy Concerns:

  • Apps: Inventory management, access control, toll collection, payment (contactless cards).

  • Concerns:

    • Eavesdropping: Intercept tag-reader communication.

    • Cloning: Copy tag ID.

    • Privacy: Unauthorized tracking (e.g., products with embedded tags).

  • Mitigations: Hash-lock, mutual authentication, kill commands (permanent disable).

[!TIP] "Principle of operation" often focuses on backscatter vs. inductive coupling—know frequency ranges and tag types.