PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey on Wireless Security: Technical Challenges, Recent Advances and Future Trends

Yulong Zou, Jia Zhu, Xianbin Wang, Lajos Hanzo

arXiv:1505.07919v2cs.ITcs.CR

TL;DR

Wireless communications are vulnerable to malicious attacks because their broadcast medium exposes transmissions and enables interference. This survey organizes threats and defenses by protocol layer, reviews standards and physical-layer techniques, and concludes with unresolved challenges, including the need to address mixed attacks and coupled design objectives.

  • Problem

    Wireless networks require protection against attacks affecting authenticity, confidentiality, integrity, and availability, but physical-layer research has largely focused on eavesdropping while neglecting combined attack types.

  • Method

    The paper systematically surveys layered vulnerabilities, wireless security protocols and algorithms, physical-layer security techniques, jamming attacks and countermeasures, and integration with existing mechanisms.

  • Results

    The survey covers attacks from the application layer through the physical layer, standards including Bluetooth, Wi-Fi, WiMAX, and LTE, physical-layer security approaches, and several jammer classes.

  • Takeaways & Limitations

    Wireless security research must consider physical-layer characteristics, jamming defenses, integration with established security mechanisms, and unresolved mixed attacks and joint design challenges.

Abstract

from arXiv · show

This paper examines the security vulnerabilities and threats imposed by the inherent open nature of wireless communications and to devise efficient defense mechanisms for improving the wireless network security. We first summarize the security requirements of wireless networks, including their authenticity, confidentiality, integrity and availability issues. Next, a comprehensive overview of security attacks encountered in wireless networks is presented in view of the network protocol architecture, where the potential security threats are discussed at each protocol layer. We also provide a survey of the existing security protocols and algorithms that are adopted in the existing wireless network standards, such as the Bluetooth, Wi-Fi, WiMAX, and the long-term evolution (LTE) systems. Then, we discuss the state-of-the-art in physical-layer security, which is an emerging technique of securing the open communications environment against eavesdropping attacks at the physical layer. We also introduce the family of various jamming attacks and their counter-measures, including the constant jammer, intermittent jammer, reactive jammer, adaptive jammer and intelligent jammer. Additionally, we discuss the integration of physical-layer security into existing authentication and cryptography mechanisms for further securing wireless networks. Finally, some technical challenges which remain unresolved at the time of writing are summarized and the future trends in wireless security are discussed.

NOMENCLATURE

Wireless security addresses threats arising from the broadcast medium by balancing authenticity, confidentiality, integrity, availability, implementation complexity, and latency. The paper surveys layered vulnerabilities, existing standards, physical-layer defenses, jamming countermeasures, and open challenges.

  • Security requirements: Security requirements include authenticity, confidentiality, integrity, and availability across the wireless OSI protocol layers.These requirements respectively concern identity verification, restricting data access, preventing unauthorized modification, and maintaining network access.
  • Design factors: Wireless security design must balance security level, implementation complexity, and communication latency alongside authentication, authorization, and encryption.The paper frames these as competing design factors for security mechanisms.
  • Security motivation: Wireless networks face eavesdropping, DoS, spoofing, man-in-the-middle, and message falsification or injection attacks because transmissions are broadcast.Unauthorized nodes can interfere with communications, while eavesdroppers can overhear sessions within transmission coverage.
  • Survey scope: The paper reviews attacks and defenses by protocol layer, surveys security protocols for Bluetooth, Wi-Fi, WiMAX, and LTE, and examines physical-layer security and jamming countermeasures.Its coverage includes information-theoretic security, artificial noise, beamforming, diversity, secret-key generation, and constant, intermittent, reactive, adaptive, and intelligent jammers.

NETWORKS

The paper organizes wireless security analysis around the OSI layers, distinguishing shared upper-layer vulnerabilities from wireless-specific PHY and MAC threats. It describes representative protocols and physical-layer attacks, including eavesdropping and jamming.

  • Layered architecture: Wireless OSI analysis covers the physical, MAC, network, transport, and application layers, with each layer presenting distinct security challenges.The paper reviews vulnerabilities and weaknesses systematically across this layered architecture.
  • Wired–wireless relationship: Wired and wireless networks share application-, transport-, and network-layer vulnerabilities, while their differing PHY and MAC layers create distinct attacks.The paper identifies the PHY and MAC layers as the principal architectural difference between wired and wireless networks.
  • Protocols by layer: Application-layer protocols include HTTP, FTP, and SMTP, while TCP and UDP operate at the transport layer and IP and ICMP operate at the network layer.TCP provides ordered delivery, whereas UDP uses a simpler model without handshaking dialogues and with lower protocol overhead.
  • Physical-layer attacks: At the physical layer, wireless broadcast propagation exposes communications primarily to eavesdropping and jamming attacks.Eavesdropping intercepts transmissions within coverage, while jamming creates intentional interference that disrupts legitimate communications.
  • Eavesdropping defense: Secret-key cryptography encrypts plaintext before transmission so that overheard ciphertext remains difficult to decode without the shared key.The source encrypts the data and the destination decrypts it using the shared secret.

B. MAC-Layer Attacks

MAC-layer attacks exploit shared-medium access and device identities, while related network- and transport-layer attacks target addressing, routing, flooding, and packet sequencing.

  • MAC-layer attacks: MAC spoofing changes a node’s assigned address to hide its identity or impersonate another node.Attackers may also steal legitimate MAC addresses by analyzing overheard traffic.
  • MAC-layer attacks: MAC-layer man-in-the-middle attacks intercept traffic, impersonate both communicating nodes, and relay their session through the attacker.The victims may believe they are communicating directly over a private connection.
  • Network-layer attacks: Network injection disrupts routers and switches by introducing forged network re-configuration commands.An overwhelming number of forged commands can paralyze the network.
  • Network-layer attacks: Smurf attacks generate large volumes of ICMP responses by sending broadcast requests with spoofed source addresses.Firewalls and limiting responses to ICMP requests are described as possible defenses.
  • Transport-layer attacks: TCP and UDP flooding overwhelm victims with packets or requests, while TCP sequence prediction enables fabricated packet injection.UDP flooding may also conceal the attacker through a spoofed IP address.

E. Application-Layer Attacks

Application-layer attacks target HTTP, FTP, and SMTP services, while Bluetooth security mechanisms separately regulate device authentication, authorization, and encrypted transmission.

  • Application-layer attacks: HTTP attacks include malware, SQL injection, and cross-site scripting against web services and data-driven applications.These attacks can disrupt transmissions, intercept information, or seek unauthorized website access.
  • Application-layer attacks: FTP applications face bounce attacks that misuse PORT commands and directory traversal attacks that exploit file-name validation.Modern FTP servers commonly refuse PORT commands to reduce FTP bounce risk.
  • Bluetooth security: Bluetooth classifies devices by trust, authentication, and authorization status, assigning service access according to those categories.Trusted devices have unrestricted service access, whereas unknown or unauthenticated devices have limited access.
  • Bluetooth security: Bluetooth authentication uses a challenge-response exchange based on the device address and link key.The verifier confirms authentication when the claimant’s response matches its independently computed response.
  • Bluetooth security: Bluetooth authorization checks whether a device may access a requested service using device and service databases.The security manager evaluates access requests through these stored security records.
  • Bluetooth security: Bluetooth encryption protects packet payload confidentiality with a stream cipher driven by keys derived from the link key and device address.Bluetooth defines non-secure, service-level, and link-level security modes for when procedures begin.

B. Wi-Fi

Wi-Fi security evolved from WEP’s shared-key authentication and RC4-based encryption toward WPA, which addresses WEP weaknesses with stronger key and integrity protection.

  • WEP: WEP uses the RC4 algorithm with a pre-shared WEP key to encrypt data streams.The paper characterizes WEP as relatively weak and containing numerous flaws.
  • WEP: WEP combines authentication and encryption to control access and protect data privacy using a shared WEP key.Its authentication uses a four-step challenge-response handshake between a client and access point.
  • WEP: WEP encryption concatenates a 24-bit initialization vector with a 40-bit key to form a 64-bit PRNG seed.A cyclic redundancy check produces an integrity check value for the plaintext.
  • WPA: WPA was proposed to address WEP’s security problems without requiring Wi-Fi users to replace their hardware.The standard provides Personal WPA with a pre-shared key and Enterprise WPA with an 802.1x authentication server.
  • WPA: WPA improves on WEP through TKIP and a message integrity check that protect Wi-Fi data integrity and confidentiality.TKIP mixes the temporal key, sequence counter, and transmitter address to derive the WEP seed.

C. WiMAX

WiMAX concentrates security functions in a MAC security sub-layer and supports authentication, authorization, and encryption mechanisms, with PKMv2 addressing PKMv1’s one-way-authentication weakness.

  • Architecture: The WiMAX protocol stack contains PHY and MAC layers, with the MAC layer divided into three sub-layers including a dedicated security sub-layer.The security sub-layer addresses WiMAX security issues and risks.
  • Authentication: PKMv1 uses one-way authentication and is vulnerable to man-in-the-middle attacks, whereas PKMv2 relies on two-way authentication.PKMv2 was introduced in later WiMAX standards including IEEE 802.16e/m.
  • Authentication: WiMAX authentication supports RSA-based and EAP-based approaches.RSA authentication uses X.509 certificates issued by a trusted certificate authority to subscriber stations and base stations.
  • Authentication: EAP-based authentication forwards a subscriber station’s identity from the base station to an AAA server over RADIUS.Available options include EAP-AKA, EAP-TLS, and EAP-TTLS, depending on capability.
  • Authorization: WiMAX authorization determines whether an authenticated subscriber station may access services by validating its request with the base station and AAA server.The request includes an X.509 certificate, encryption algorithm, and cryptographic identity.

D. LTE

LTE combines an EPC and E-UTRAN architecture with EPS-AKA authentication and key agreement to secure packet exchange. Its security mechanisms include two-way authentication and ciphering and integrity-key generation.

  • LTE architecture: LTE comprises an EPC and an E-UTRAN containing eNodeBs, user equipments, and optional relay stations or HeNBs.The EPC includes the MME, serving gateway, PDN gateway, and HSS.
  • EPS-AKA authentication: EPS-AKA defends LTE against redirection, rogue base-station, and MITM attacks through two-way authentication between UEs and the EPC.The protocol supports secure packet exchange between user equipments and the evolved packet core.
  • EPS-AKA authentication: The MME obtains an EPS authentication vector from the HSS after requesting the UE’s identity and forwarding its IMSI and serving-network identity.The vector contains RAND, XRES, AUTN, and KSIASME quantities.
  • Ciphering and integrity: LTE adopts SNOW 3G as a more secure ciphering technique than the vulnerable KASUMI algorithm used in UMTS.KASUMI is described as vulnerable to related-key attacks.
  • Security mechanisms: Wireless standards commonly rely on upper OSI layers, including MAC, network, and transport layers, for authentication and data encryption.The survey contrasts LTE with WEP/WPA in Wi-Fi and PKM in WiMAX.

V. WIRELESS PHYSICAL-LAYER SECURITY AGAINST EAVESDROPPING

Physical-layer security protects wireless communications against eavesdropping by exploiting wireless-channel characteristics. The survey organizes techniques into information-theoretic, artificial-noise, beamforming, diversity, and secret-key-generation approaches, while highlighting channel and CSI challenges.

  • Overview: Physical-layer security addresses eavesdropping in broadcast wireless environments where fading and signal overhearing reduce secrecy.The main link connects source and destination, while the wiretap link connects the source and eavesdropper.
  • Technique taxonomy: The survey classifies physical-layer security into information-theoretic security, artificial noise, beamforming, diversity, and secret key generation.These five categories are summarized in Fig. 18.
  • Information-theoretic security: Information-theoretic security studies fundamental secrecy limits, including wiretap-channel transmission without secret keys and secrecy capacity.Secrecy capacity is the difference between main-link and wiretap-link capacities.
  • Open challenges: Wireless fading can severely degrade secrecy capacity, and practical security designs must address unavailable eavesdropper CSI.The survey identifies time-varying fading and passive-eavesdropper CSI estimation as unresolved constraints.
  • Information-theoretic security: MIMO techniques can increase secrecy capacity in fading environments, but analyses often distinguish idealized known-CSI settings from more practical fading scenarios.Passive eavesdroppers make their channel state information difficult to estimate.

B. Artificial Noise Aided Security

Artificial-noise security injects interference designed to degrade the eavesdropper’s channel while preserving the legitimate receiver’s channel. The approach can improve secrecy but trades against transmit-power use and must account for QoS and imperfect CSI.

  • Artificial-noise mechanism: Artificial noise reduces the wiretap channel’s capacity while leaving the desired channel unaffected, thereby increasing secrecy capacity.Multiple antennas can generate interference that targets the eavesdropper, even when it is closer to the source than the destination.
  • Power allocation: Artificial-noise security consumes transmit power because part of the source’s power is allocated to interference generation.The power-sharing problem balances information-bearing transmission against artificial noise.
  • Power allocation: Equal power sharing is near-optimal when eavesdroppers do not collude, while more eavesdroppers call for more artificial-noise power.With imperfect CSI, allocating more power to jamming can improve security performance.
  • QoS and robustness: QoS-oriented designs minimize the maximum eavesdropper SINR while guaranteeing satisfactory SINR for the legitimate destination.Robust designs consider perfect main-channel CSI and imperfect wiretap-channel CSI.
  • Cooperative protection: Cooperative relays can generate artificial noise while a messaging relay assists legitimate transmission from source to destination.This extends artificial-noise protection beyond source-side multiple-antenna generation.
  • Beamforming: Security-oriented beamforming directs the information signal toward the destination so destructive interference weakens reception at eavesdroppers.A reported beamforming design significantly increased secrecy capacity.
  • Beamforming: Beamforming designs can use multiple antennas without assuming exact eavesdropper CSI and can be jointly optimized with artificial noise.The survey also describes cooperative and non-cooperative relay beamformers.

D. Diversity Assisted Security Approaches

Diversity techniques improve physical-layer security by exploiting antennas, multiple users, or relays to combat fading without the extra power required for artificial noise. Physical-layer key generation additionally exploits channel characteristics, but depends on channel assumptions and can incur complexity or attack risks.

  • Diversity-assisted security: Diversity-assisted security can enhance wireless security without allocating additional transmit power to artificial-noise generation.Its traditional reliability benefits also support secrecy against eavesdropping.
  • Transmit diversity: Multiple-antenna transmit diversity combats fading and can increase secrecy capacity by selecting antennas using available channel state information.The selection strategy depends on whether main- and wiretap-channel CSI is available.
  • Multiuser diversity: Multiuser diversity protects transmissions by scheduling users onto OFDM subbands in cellular systems such as LTE.The broadcast medium still allows eavesdroppers to intercept source messages.
  • Cooperative diversity: Cooperative diversity uses multiple relays to assist source-to-destination transmission, with best-relay selection supporting protection against eavesdropping.The approach is illustrated as a source, multiple relays, a destination, and an eavesdropper.
  • Secret key generation: Physical-layer key generation exploits reciprocal wireless-channel characteristics so legitimate devices can derive shared secret keys.Alice and Bob estimate reciprocal channel gains between their two transmission directions.
  • Secret key generation: RSS-based key extraction has a low key-generation rate, whereas channel phase and MIMO randomness can improve key-generation capability.MIMO-based generation increases system complexity because estimating more antennas requires additional computing and memory resources.
  • Secret key generation limitations: Physical-layer key-generation schemes rely on reciprocal main channels uncorrelated with wiretap channels, an assumption that may fail in practical scenarios.Channel correlation can enable passive inference, and practical MITM attacks against key generation have been demonstrated.
  • Authenticated key generation: Authenticated secret-key generation can combine device authentication with key extraction by using relatively static and dynamically fluctuating wireless channels.The approach was studied for wireless body-area networks under routine body movements.

VI. WIRELESS JAMMING ATTACKS AND THEIR COUNTER-MEASURES

Wireless jamming attacks exploit the shared radio medium or upper-layer protocol vulnerabilities to disrupt legitimate transmissions. The survey distinguishes five jammer categories and relates them to their operating layer.

  • Jamming attacks interfere with legitimate wireless transmission or reception by emitting unwanted signals over shared channels.The survey frames jamming as a consequence of the shared nature of radio propagation.
  • Five jammer categories are identified: constant, intermittent, reactive, adaptive, and intelligent.The first four operate at the physical layer, while intelligent jammers exploit upper-layer protocols.
  • Constant jammers transmit continuously, whereas intermittent jammers transmit periodically and reactive jammers transmit only after detecting legitimate activity.
  • Adaptive jammers tailor their signal to the received power at the legitimate receiver, while intelligent jammers exploit weaknesses in upper-layer protocols.

A. Constant Jammer

Constant jammers continuously raise interference and keep the channel busy, disrupting communications but consuming substantial energy. Detection uses abnormal signal statistics, and frequency hopping provides a countermeasure.

  • Constant jammers continuously transmit signals that degrade reception and prevent legitimate transmitters from accessing the channel.Their signals may use arbitrary waveforms within limited bandwidth and power constraints.
  • Constant jammers can disrupt legitimate communications across wireless systems, but continuous transmission makes them energy-inefficient.
  • Received signal strength, carrier sensing time, and packet error rate can reveal abnormal activity associated with constant jamming.
  • Packet error rate is normally below 0.1, is unlikely to exceed 0.2 in highly congested networks, and can approach one under effective jamming.
  • Frequency hopping changes the carrier frequency using a shared pseudo-random sequence to protect transmissions after jamming is detected.Reactive hopping switches channels only after detection, reducing the number of hops compared with proactive hopping.
  • Intermittent and reactive jammers also affect RSS, CST, and PER, while reactive jammers are more energy-efficient because they remain silent on idle channels.

D. Adaptive Jammer

Adaptive jammers adjust their power using information about the legitimate link, making them difficult to detect but often idealized in practice. The section also contrasts protocol-aware intelligent jamming and summarizes physical-layer security integration.

  • D. Adaptive Jammer: Adaptive jammers adjust jamming power to disrupt the legitimate receiver according to time-varying received signal strength.
  • D. Adaptive Jammer: Adaptive jammers require knowledge of the legitimate receiver’s channel conditions, limiting practical use and making them useful as idealized benchmarking attackers.
  • D. Adaptive Jammer: Adaptive-jammer detection is challenging because the jammer can conceal itself by adapting power and remaining silent when transmissions are inactive.RSS and PER can be used, whereas carrier sensing time is ineffective when the jammer does not transmit during inactivity.
  • D. Adaptive Jammer: Channel surfing and spatial retreating evade adaptive jammers by changing the jammed channel or moving away from the jammed area.Spatial retreating requires accurate jammer localization.
  • E. Intelligent Jammer: Intelligent jammers target critical MAC control packets, such as RTS, CTS, and ACK frames, rather than data packets.This approach can reduce the jammer’s energy consumption while blocking legitimate communication.
  • E. Intelligent Jammer: Table XII compares jammer types by energy efficiency, jamming effectiveness, implementation complexity, and prior-knowledge requirements.Constant and intermittent jammers are simple but energy-inefficient, whereas adaptive and intelligent jammers are efficient and complex; reactive jammers are intermediate.
  • VII. Integration of Physical-Layer Security: Physical-layer security is surveyed as a complement to conventional authentication and cryptography, including hardware-, channel-, and fingerprint-based authentication.
  • VII. Integration of Physical-Layer Security: ARQ-aided physical-layer cryptography can significantly improve secrecy even when legitimate users lack knowledge of the eavesdropper’s channel conditions.

VIII. OPEN CHALLENGES AND FUTURE WORK

The paper identifies unresolved challenges and future directions for wireless security research. It presents these issues as an open research agenda rather than a completed problem.

  • Numerous wireless security challenges and issues remained open at the time of writing despite extensive prior research.

A. Mixed Attacks in Wireless Networks

The section identifies unresolved challenges in defending wireless networks against mixed attacks while jointly balancing security, reliability, and throughput. It also highlights practical constraints from cross-layer design, emerging 5G technologies, and imperfect channel-state information.

  • Mixed attacks in wireless networks: Physical-layer security research has largely treated eavesdropping separately, leaving joint defenses against eavesdropping and DoS attacks unresolved.Mixed-attack defenses may require CSI for the main, interfering, and wiretap links under full or partial knowledge.
  • Joint optimization of security, reliability and throughput: Security, reliability, and throughput are coupled, so optimizing them independently can produce suboptimal wireless-system designs.Higher transmit power can improve the main link while increasing wiretap-channel capacity, whereas higher data rates can reduce interception probability but increase outage probability.
  • Cross-layer aided security design: Cross-layer security design remains in its infancy and seeks efficient information exchange across protocol layers with minimal network overhead.The approach spans the physical, MAC, network, transport, and application layers.
  • 5G technologies and physical-layer security: Combining physical-layer security with massive MIMO and mmWave technologies raises challenges involving pilot contamination, power allocation, and channel reciprocity.These technologies are presented as 5G-enabling opportunities whose security integration remains important to investigate.
  • Imperfect CSI: Artificial-noise, beamforming, and diversity schemes have shown theoretical secrecy benefits under idealized assumptions such as perfect CSI knowledge.CSI estimation errors can prevent artificial noise from interfering with eavesdroppers without also affecting legitimate receivers.

IX. CONCLUSIONS

The survey synthesizes wireless security threats, defenses, and design principles across protocol layers and deployed standards, emphasizing physical-layer techniques and their integration with conventional security. It also identifies unresolved challenges involving mixed attacks, cross-layer design, joint optimization, emerging 5G systems, and real-world validation.

  • Conclusions: The survey reviews attacks across application, transport, network, MAC, and physical layers, alongside security paradigms for Bluetooth, Wi-Fi, WiMAX, and LTE.Its guidelines state that layer-specific mechanisms should be customized to address differing protocols and vulnerabilities.
  • Conclusions: Physical-layer security techniques surveyed include information-theoretic security, artificial noise, beamforming, diversity, and secret-key generation, alongside jamming detection and prevention.The paper also discusses integrating physical-layer security with wireless authentication and cryptography.
  • Conclusions: Open research challenges include defending against mixed attacks, jointly optimizing security, reliability, and throughput, combining physical-layer security with 5G technologies, and conducting field experiments.The paper specifically calls for validation without the idealized simplifying assumptions common in theoretical studies.
  • Conclusions: Cross-layer security is proposed because separately protecting protocol layers results in high latency and overhead; physical-layer channel characteristics may customize authentication and key-generation algorithms.This direction seeks reduced security overhead and latency compared with conventional layered mechanisms.
  • Conclusions: Artificial noise, beamforming, and diversity can improve wireless secrecy, but their benefits involve trade-offs in power allocation, throughput, reliability, or channel-estimation overhead.Artificial-noise power can degrade the legitimate receiver, while accurate channel estimation increases transceiver complexity and CSI feedback overhead.
Loading 1505.07919v2…