CHAPTER 1 Introduction

1.1 Motivations

1.2 Crypto attacks on WLANs

1.2.1 Traffic analysis

1.2.2 Eavesdropping

1.2.3 Man-in-the-middle

1.2.4 Session hijack

1.2.5 Masquerading

1.2.6 Unauthorized access

1.2.7 Replay（or Playback）

1.2.8 Tampering

1.2.9 Forgery

1.3 Approaches to resolve crypto attacks

1.3.1 Wired equivalent privacy

1.3.2 802.11i（TKIP,CCMP）

1.3.3VPN solution against crypto attacks

1.4 Denial of service（DoS）

1.5 Related DoS research work

1.6 Proposed approaches and contributions

1.6.1 Contributions to resolve crypto attacks

1.6.2 Contributions to resolve DoS attacks

1.7 Outline

CHAPTER 2 Experimental Methodologies

2.1 Summary of tools

2.1.1 Pcattcp

2.1.2 WireShark

2.1.3 FreeRadius server

2.1.4 HostAP

2.1.5 Void11 attacking tool

2.1.6 Wireless sniffer

2.1.7 Network simulation

2.2 Performance measurements

2.2.1 TCP throughput

2.2.2 Round trip time

2.2.3 TCP time-sequence graph

2.2.4 UDP throughput and packet loss

2.3 Experimental design

2.3.1 Network emulation of AuthRF and AssRF attacks

2.3.2 Network emulation of DeauthF/DisassF attacks

2.4 Queuing model

CHAPTER 3 Protect Wireless LANs using VPN over 802.11i

3.1 Introduction

3.2 Five S problems of enterprise WLANs

3.2.1 Security attacks on wireless communication（SAOWC）

3.2.2 Stealing wireless resources（SWR）

3.2.3 Sniffing internal traffic（SIT）

3.2.4 Sharing internal resources（SIR）

3.2.5 Security backward compatibility（SBC）

3.2.6 Summary of 5S problems

3.3 Security approaches for five S problems

3.3.1 WEP

3.3.2 WEP-802.1X

3.3.3 VPN/WEP-802.1X

3.3.4 802.11i（TKIP,CCMP）

3.3.5 VPN over 802.11i（TKIP,CCMP）

3.3.6 Summary of security approach

3.4 Experiments and methodologies

3.5 Performance analyses

3.5.1 Throughput vs.security measures

3.5.2 Overheads of security approaches

3.5.3 Performance of VPN/802.11i-TKIP

3.6 Theoretical analyses of performances

3.6.1 Theoretical analyses of WLAN throughputs

3.6.2 Analysis of packet encryption time

3.6.3 Analysis of packet transmission time

3.6.4 Performances of VPN/802.11i

3.7 Conclusions

CHAPTER 4 AuthRF and AssRF DoS Attacks

4.1 Empirical study of AuthRF and AssRF attacks

4.1.1 Hardware sensitivity

4.1.2 Traffic sensitivity

4.1.3 Empirical study of AuthRF/AssRFon TCP traffic

4.1.4 Empirical study of AuthRF/AssRF on UDP traffic

4.2 Queuing models of WLANs

4.3 Qualitative performance analyses

4.3.1 Data and management frame flows under AuthRF/AssRF

4.3.2 Difference between upstream UDP and other data streams

4.3.3 AuthRF/AssRF effects vs.attacking rates

4.4 Quantitative performance analyses

4.4.1 Analysis of TCP RTT

4.4.2 Analysis of UDP packet loss

4.5 Discussion of performance results

4.5.1 TCP performance results

4.5.2 Upstream UDP packet loss

4.5.3 Downstream UDP packet loss

4.5.4 Data sending rate sensitivity analysis

4.6 Approaches to resolve DoS attacks

4.6.1 Request authentication

4.6.2 Reduction of duplicate requests

4.6.3 Reduction of response retransmission

4.6.4 Round robin transmission

4.6.5 Comprehensive performance study of RA,R DR,RRR and RRT

4.6.6 Comparisons of RA,RDR,RRR and RRT

4.7 Conclusions

CHAPTER 5 DeauthF and DisassF Attacks

5.1 Effects of DeauthF and DisassF on traditional WLANs

5.1.1 DeauthF/DisassF hardware sensitivity

5.1.2 DeauthF and DisassF attacks on TCP/UDP traffic

5.1.3 802.11 operations under RAP attacks

5.2 802.11w-Protection of management frames

5.2.1 802.11w standard background

5.2.2 802.11w implementation

5.2.3 Validation of 802.11w implementations

5.2.4 Evaluation of 802.11w

5.3 STA-based queuing model

5.4 Qualitative analysis

5.4.1 TCP data flow

5.4.2 UDP data flow

5.4.3 Analysis of TCP RTT and UDP packet loss

5.5 Approach to resolve DeauthF/DisassF attacks

5.6 Conclusions

CHAPTER 6 RAP DoS Attacks with Markov Chain Model

6.1 Introduction

6.2 Experimental methodologies

6.2.1 WLAN DoS experiments

6.2.2 WLAN DoS simulation

6.3 Theoretical studies of DoS attacks

6.3.1 Markov chain model

6.3.2 Wireless client Markov chain model

6.3.3 Analyses of DeauthF and DisassF

6.4 Implementation of 802.11w

6.4.1 Deauthentication and disassociation frames

6.4.2 Hash function for authentication

6.4.3 Encryption mechanisms for authentication

6.5 Analyses of 802.11w

6.5.1 Normal WLAN

6.5.2 WLAN under DeauthF

6.5.3 802.11w-enabled WLAN under DeauthF

6.5.4 802.11w-TPF enabled WLAN under DeauthF

6.5.5 Summary of four cases

6.6 Conclusions

CHAPTER 7 DoS Attacks against Wireless VoIP

7.1 Introduction

7.2 Backgrounds of DoS attacks on WVoIP

7.3 Experimental Design of WVoIP

7.4 DoS attacks on WVoIP

7.4.1 Authentication request flooding attack on WVoIP

7.4.2 Association request flooding attack over WVoIP

7.4.3 RAP based deauthentication flooding attack over WVoIP

7.4.4 RAP based disassociatiot flooding attack

7.4.5 Solutions to DoS attacks on WVoIP

7.5 Conclusions

CHAPTER 8 Layer-3 Forwarding on Wireless LANs

8.1 Introduction

8.2 Bridging with layer-3 forwarding

8.2.1 Layer-2 bridging and IP routing

8.2.2 Layer-3 forwarding（L3F） process

8.3 Experimental design

8.4 Performance results

8.5 Conclusions

CHAPTER 9 Wireless Device Server Based Sensor Management Systems

9.1 Introduction

9.2 Wireless device server based management system

9.2.1 Multiple tier and hierarchy architecture of WDSBISFMS

9.2.2 WDSBISFMS functionalities

9.2.3 WDSBISFMS implementation examples

9.3 Application examples of WDSBISFMS

9.3.1 WDSBISFMS for fixed sensors

9.3.2 WDSBISFMS for mobile sensors

9.3.3 WDSBISFMS for airplane imaging system

9.3.4WDSBISFMS for monitoring data center

9.4 Sensor technologies and sensor management standardization

9.5 Conclusions

CHAPTER 10 Summary of Contributions and Future Works

10.1 Contributions on the experimental studies

10.1.1 Design of experiments

10.1.2 Data collection and performance metrics

10.1.3 Enhancement of tools

10.1.4 Enhancement of NS-2 simulations

10.2 Contributions on the theoretical modeling

10.2.1 VPN performance overhead analysis

10.2.2 Queuing model for the authentication and association process

10.2.3 Queuing model for the deauthentication and disassociation process

10.3 Solutions to enhance WLAN security

10.3.1 Integrated solution

10.3.2 Solutions to AuthRF and AssRF attacks

10.3.3 Enhancement to 802.11w

10.4 Future work

Derivation of Trand Ta

Derivation of RX response time（t2）

Derivation of TX2 response time（t5）