Security issues of Relay-Based IEEE 802.

16m Networks

A. S. Khan, N. Fisal, S. K. S. Yusof, S. H. S. Ariffin, N. N. Maarof, M. Abbas

UTM-MIMOS Center of Excellence in Telecommunication Technology,
Faculty of Electrical Engineering, Universiti Teknologi Malaysia, 81310 Skudai, Johor, Malaysia.
Wireless Communication Cluster, MIMOS Berhad, Technology Park Malaysia

Abstract--A WiMAX network usually operates in a

highly dynamic and open environment therefore it is
known to be more vulnerable to security holes. In this
abstract, we discussed some security issues and
propose a new fully trustworthy authentication and
key management approach for Vulnerabilities in
Relay-Based IEEE 802.16m Networks. The propose
scheme uses distributed authentication and key
management approach for hop-by-hop authentication.
We uses distributed non-transparent, decode and
forward multi-hop relays that is responsible for
localized authentication. Both analysis and
performance evaluation shows that less complex
distributed and trustworthy scheme can significantly
increase the throughput, and reduce the security holes
as well as communication overheads
Keywords: Wimax Security, Mesh Network, Key Management,
Denial of service, replay attacks

1.

Introduction

Wimax has security vulnerabilities which, if it

were possible to create a significant disruption in
communication with little effort from the attacker,
could threaten its wide spread deployment. During
the registration process, an RS can be configured to
operate in distributed security mode based on its
capability called NRS. Since message 1 is optional
and informative we begin with the security analysis
from the message II discussed by author [1][2], as
this message is plain text but eavesdropping is not a
problem since the information is almost public and is
preferred to be sent in plain text to facilitate
authentication , however, Non-transparent Relay
(NRS) may face a replay attack from an adversary
who intercepts and saves the authentication messages
sent by a legitimate NRS previously, although an
adversary eavesdropping the message cannot derive
the AK from message, because it doesnt have the
corresponding private key the adversary still can

replay message II multiple times and then either

exhaust NRS capabilities or force NRS to deny the
SS who owns that certificates. The reason is that if
NRS sets a timeout value which makes NRS reject
Auth REQ from the same MS in a certain period , the
legitimate request from the victim MS will be
ignored. Then denial of service attack occurs to
victim MS , however the ultimate solution for these
types of attacks are the introduction of signatures at
the end of the messages and digital signature can be
automatically time-stamped which basically provides
the authentication and non-repudation of this
message. The design of digital signature system may
be flawed or vulnerable to some specific attacks like
collision attacks against X.509 public-key
certificates. Cryptographically weak pseudo random
bit generator. Adversaries may attempt for total
break, universal forgery, selective forgery or
existential forgery.
The rest of the paper is organized as follow, after
related work, section 3 gives the overview of generals
attacks on network, then section 4 discuss centralized
and distributed authentication controls, section 5,
describe the self-organize system model, section 6
gives the analysis of proposed scheme which is
followed by conclusion and future work.

2.

Related Works

In 2006, the IEEE 802.16 working group (WG)

approved a project Authorization Request (PAR)
focused on the Relay Tasks Group (TG). Relay
stations concept as discussed in [1][4] and [3]
introducing four types of RSs from the perceptive of
physical and Mac layer. After successful comparison,
the main focus is on the non-transparent RS operating
in distributed scheduling and security mode [3], due
to its throughput improvement, coverage extension
and high bandwidth efficiency nature. As the matter
of fact, due to lack of physical boundaries, the whole
relay-based mesh infrastructure in expose to security
holes. there are some papers they purely works on

key managements specially Sen Xu and Manton

Mathews who published a series of work like [1] and
[8] on security issues on the standard as well as on
Privacy key Management protocols (PKM). Karen
Scarfore with his team come up with a special
publication on Guide to security for Wimax
technologies(Draft) which was the recommendations
of the national institute of standards and
technology(NIST). Taeshik Shon, Wook Choi [9]
discussed about the Analysis of Mobile WiMAX
Security, Vulnerabilities and Solutions. Y.Lee and
H.K.Lee in their paper [3] gives more focus on
hybrid authentication scheme and key distribution for
MMR in IEEE 802.16j.
The authors [10] and [11] review the standard and
analyzed its security in many aspects, such as
vulnerabilities in authentication and key management
protocols and failure in data encryption. Very sparse
work is done specially on DoS and replay attacks
such as [2][ 3][ 4], However none of these above
publications cover the DoS and replay attacks issues
and proposed low-complex and high throughput
scheme for the trustworthiness, authentication and
key Relay-based WiMAX in a detailed way to open
the new way of thinking for the researchers in the
field of security in WiMAX.

3.

4.

Proposed Trustworthy Authentication and

Key Management Scheme

4.1 Authentication Procedures of NRS1 with MR-BS

In our proposed approach, NRS1 received
the AUTH-REQ (NRS2) and send it to MR-BS
during the refreshing of AK message because these
authentications are delay tolerance. After MR-BS
validates NRS2 it send AK2 and SAID list to NRS1
in its AUTH-REP message, here NRS1 send AK21
and SAIDLIST encrypted with the NRS2s public
key. At this stage, NRS2 start sending reauthorization
request directly to NRS1 and NRS1 is responsible for
sending all the refresh keys, as we already mentioned
that these relays are non- transparent decode and
forward working in distributing security mode [3]. So
can generate AUTH-REP on the behalf of MR-BS
but cannot authenticate its real validity as its does not
contains the vendors digital certificate database. Thus

General Attacks on Relay-Based WiMAX

Network

Before we start to elaborate our operation of the

self-organized algorithm, we would like to introduce
some typical attacks on authentication and key
management protocols. Message replay attack is one
of the most common attacks on authentication and
authenticated key establishment protocols [9]. In a
replay attack, the attacker captures a transmitted
message and resends it after certain amount of time,
for example, MR-BS/NRS may face a replay attack
from an adversary who intercepts and saves the
authentication messages sent by legitimate NRS/MS
previously [11]. Dos attacks on the BS/NRS could
happen during the PKMv2 authentication because of
the heavy public key computational load. Here, we
assume that the attacker is external to the network
and is able to analyze the unencrypted parts of the
management traffic and observes the timing, size, and
source of traffic. Attacker can prevent or hinder
communication with little effort by disrupting certain
important packets. All messages communicated prior
to secure key exchange between BS and NRS/MS/RS
are not authenticated. Man-in-the Middle attack is
another classic attack and is generally applicable in a
communication
protocol
where
mutual
authenticationis absence [3].

Figure 1: Authentication of NRS1 with MRBS

NRS2s AK and TEK state machines start sending
refreshing of the keys materials request to NRS1 and
NRS1 response with new keys on behalf of MR-BS
as shown in figure 4. If NRS1 fails to re-authenticate
before the expiration of its current AK, the MR-BS
will hold no active AKs for NRS1 and will consider
NRS1 unauthorized. A MR-BS will remove from its
keying tables all TEKs associated with NRS1
[standard]. The beauty of our novelty is all NRSs
maintains the tables we called this table knowledge
shared table (KST) of recently exchanged AK with
its neighbors and if NRS2 fails to re-authenticate
before the expiration of its current AK, NRS1 will
wait until it send AUTH-REQ message, NRS1 will
check its KST, if it found then validates its
authenticity locally rather than sending again to MRBS and wait for the response and compute the keys

and send to NRS2, the advantage

communication cost and less complexity

is

the

4.2 Authentication Procedures of NRSn with

NRS1/MR-BS
NRS3 send its AUTH-REQ message to MRBS, the request will move through authenticated
relays as only authenticated relays start sending ULMAP messages. All the intermediate NRS will save
the copy of the request in its KST, as this request
contains its most confidential data. After successful
validation MR-BS send the AUTH-REP to
neighboring NRS1, NRS1 knows that this message is
not from NRS2 because NRS1 have all the updated
KST so it will again encrypt this message with public
key of NRS2 and send back in AUTH-REP message
and NRS2 also save the SAIDLIST information in its
KST and send back in AUTH-REP to NRS3 with its
own generated AK23 on behalf of MR-BS as shown
in figure 5. As all NRS consider their serving NRS as
MR-BS [3].
4.3 Localized and Distributed Key Management in
Relay-Based WiMAX Mesh Network
We assume that all the NRS are authenticated
and maintains theirs KST. Inside the KST, we have
two portions, one is updated and other is non-updated
stacks, all the active and valid AK, TEK and
SAIDLIST are resides inside the updated one, and all
Figure 3: All NRSs are get authenticated
the expired and revoked keys are inside that nonupdated stack.

If any new NRS want to join the network, the serving

NRS first look at in its KST in updated stack, if it
cannot find the required information, it will move to
non-updated stack, if still it cannot find inside nonupdated stack, the serving NRS will send the AUTHREQ to the MR-BS through other NRS and all other
procedures are same. And if incase it found in either
of the stack, it validate its authenticity and send
SAIDLIST and AK in AUTH-REP message and
send one copy to the MR-BS for its own KST. MRBS validates its authenticity, if its valid then it will
save in its KST else send AUTH-REJECT message
in AUTH-REP.now the entire network is doing
distributed authentication.
5.

Analysis of Our Proposed Approach

5.1 Evaluation against Denial of Service

Denial of service is one of the major attacks in
wireless networks especially in Wimax. Lets
suppose, any NRSk which is basically attacker, sends
AUTH-REQ message, which is always a plain text
but eavesdropping is not a problem since the
information is almost public and is preferred to be
send in plaintext to facilitate authentication. MR-BS
may face replay attack from the adversary who
intercepts and saves the message, here, an adversary
eavesdropping the message cannot derive the AK as
its doesnt have corresponding private key, this
adversary still can replay AUTH-REQ message

5.2 Evaluation against Reply Attack

As in section 3, we have described briefly about
the replay attack and our related work not only
focused on the research trends but also shows the
weaknesses. Our self-organized scheme can handle
easily with replay attack, lets suppose, any attacker
pretend NRS and send AUTH-REQ message, this
AUTH-REQ message will be validated by different
NRS repositories, and if cannot found then we
consider attacker as impersonates, and secondly we
use nonce version of authentication protocol so with
all together, its very difficult for the attacker to do
replay attack, and the beauty of our scheme is after
several messages exchanged within the network, the
network become more secure and truth worthy
Figure 2: Localized authentication amongst
NRS

6.

Conclusion and Future Work

In this abstract, we addressed a novel, hop-byhop authentication and key management scheme in
non-transparent Relay-based WiMAX mesh network.
If any NRS cannot refresh its key within particular
given time due to uncertain circumstances, according
to standard, it have to re-authenticate with MR-BS,
but in our scheme, it will send the request to NRS,
NRS will look into its local repositories, if found then
send AK/SAID by itself, else send the request to
other neighbor NRS, if all the NRSs could not
manage to find requesting NRS security particulars, it
will send the AUTH-REQ to MR-BS for
authentication and validation and consider it as a new
NRS/MS.
Acknowledgement
The author would like to thanks to all
WiMAX research group for their constant help in this
topic. This work is fully funded By Ministry of
Higher Education under Malaysian Technical
Cooperation Programme (MTCP) award and partially
by MIMOS BERHAD.

References
[1]
[2]

[3]

[4]

[5]

[6]

[7]
[8]

S. Xu and Huang. Attack on PKM protocols of IEEE 802.16

and its later version. In international Symposium on wireless
Communication System (ISWCS), 2006.
M. Abadi and R. Needham, Prudent Engineering Practice for
Cryptographic Protocols, IEEE transactions on Software
Engineering, 1995.
Mosato Okuda, Chenxi Zhu and Dorin Viorel, Multihop
Relay Extension for Wimax Networks- Overview and
Benefits of IEEE 802.16j Standard, FUJITSU Sci.Tech.J.,
44,3, p.292-302 (July 2008)
Adnan Shahid Khan, Prof.Dr.Norsheila Fisal, Sazzad
Hossain, Man-in-the-Middle Attack and possible solutions
on Wimax 802.16j.In proceedings of International
Conference on Recent and Emerging Advanced Technologies
in Engineering (iCREATE 2009). Pan pacific KL
international airport Hotel Malaysia, 22-24 November 2009.
Y.Lee, H.K.Lee, G.Y.Lee, H.J.Kim and C.K.Leong, Design
of Hybrid Authentication Scheme and Key Distribution for
Mobile Multi-Hop Relay in IEEE 802.16j, EATIS09, June
3-5, Prague,CZ, 2009.
Adnan Shahid Khan, Prof.Dr.Norsheila Fisal, Abdelhamid.
Security Sublayer : A Required Evolution of Wireless
Security IEEE 802.16j.In proceedings of IEEE international
Conference on Antenna Propagation and System (INAS
2009) Grand paragon Hotel, Johor Bahru, 3-5 December
2009
Huang C, Chang J. Responding to security issues in Wimax
networks. IT Professional 2008; 10(5):15-21
S. Adibi, G. B. Agnew,T. Tofigh, End-to-End (E2E) Security
Approach in WiMAX: Security Technical Overview for
Corporate Multimedia Applications, 747-758, Handbook of

Research on Wireless Security (2 Volumes) Edited By: Yan

Zhang, Jun Zheng, Miao Ma, 2008.
[9] Sen Xu, Manton Matthews and Chin-Tser Huang. Security
Issues in Privacy and Key Management Protocols of IEEE
802.16. In ACM SE'06. Florida USA. March 2006
[10] Taeshik Shon, Wook Choi: An Analysis of Mobile WiMAX
Security:
Vulnerabilities
and
Solutions,
First
InternationalConference, NBiS 2007, LNCS, Vol. 4650, pp.
88-97, 2007.
[11] Adnan Shahid Khan et. al. Efficient Distributed
Authentication Key Scheme for Multi-hop Relay In IEEE
802.16j Network, International Journal of Engineering
Science and Technology (IJEST), Vol. 2(6), 2010, 2192-2199