Search

In the field of Cybersecurity, it is essential to know who is connected to your system. The functionality for Authentication of connecting users in the local area network is in the focus for this report. There exist various authentication protocols, however in this report IEEE 802.1X is covered since it is the protocol most suitable for wired local area networks. The IEEE 802.1X protocol is studied in theory with its architecture of Supplicator, Authenticator and Authentication server and the used communication protocols EAPOL and RADIUS. A practical test was then performed as a basic concept to learn more about pros and cons for utilizing these protocols where the fundamentals of protocol communications are observed and later the prerequisites for a larger scale implementation are described. The outcome from the test is proof of the relative difficulties involved with having to keep up with the pace of Cybersecurity evolution. In the test, older equipment where thought to be used, however due to incompatibility of gear and software the test needed to be revised to use other gear. The learning outcome from the test is that it is a complex task to set up authentication, competent staff are needed, as well as suitable equipment. The motivation for setting up IEEE 802.1X is found in larger organizations where the risks of an attack are high, the large number of users calls for centralized systems for the handling of users and network policies. Due to the trend of Bringing you own device, a policy for the handling of unauthorized users and devices is needed to be in place. The default behavior may be to just deny access for unauthorized devices, however with authentication systems implemented the unauthorized user may instead benefit from being automatically referred to a guest network in a secured manner and the authorized user gains flexibility to access the network thru any available network port. For the improvement and maintenance of Cybersecurity administration an Information Security Management System is found useful, the organization can thereby continuously improve their work and document the system features and routines. In case of a security breach that system gives support for immediate action upon the problem, and even stronger preparation for the Cyber defense in the form of good backup routines and monitoring the normal state activities where all devices are either authorized or unauthorized and placed into their proper network according to network policies. Examensarbete för högskoleingenjörsexamen i nätverksteknik

The access point configuration used for wireless connections in Amikom is manually configured one by one. Each access point is configured using several SSIDs based on the department that will connect to the access point. The use of multiple SSIDs in one access point turned out to have a bad effect on network performance, from the test results, for access points configured with more than four SSIDs, the connection was very slow. The security standard used for connection from the user to the access point is WPA Personal, where WPA Personal can be said to be very weak because for each SSID it will use the same user and password for all users, this is often the cause of access leaks. To improve network security and make it easier for the author to do maintenance on the network, the author tries to use the IEEE 802.1X protocol that is connected with RADIUS and access point controllers so that the configuration and maintenance of wireless networks can be centralized, user administration and passwords can also be centralized server radius and also a better level of security using WPA Enterprise security in the IEEE 802.1X protocol.

Broadband Power Line Communications (BPL) has the potential to play a significant role in the German smart grid, due to its high data rate. Although BPL may offer significant competitive benefits, the possible negative impact that BPL may have on security may be a more important factor in BPL deployment. In this paper, security issues regarding the current implementations of ITU-T G.hn BPL for access networks are discussed. It has been shown that an authentication using AES-128 on the physical layer cannot grant the authenticity. Security requirements to improve the actual situation are introduced. Furthermore, three security concepts in different complexities to adapt the key features of IEEE 802.1X into G.hn are presented. The first concept is based on the encryption of the content of the authentication messages during the handshake. The second concept extends the previous one with additional response messages. The last concept is based on the insertion of EAP-TLS authentication to validate the possession of the private keys.

We present in this paper a mechanism to provide intelligent QoS to IEEE 802.11e compliant devices. Our mechanism combines two schemes previously proposed in the literature, while at the same time offers considerable improvements on traffic management for the enhanced distributed channel access (EDCA) mode for IEEE 802.11e. We evaluate our mechanism, called ACI-EDCA, by simulations with the NS-2 simulator. We test the performance of our proposal with four classes of traffic: Voice over IP (VoIP), Video on Demand (VoD), best-effort, and background traffic. This work extends previous findings mainly focused on the analysis of throughput and medium access collisions. Since the IEEE 802.11e is considered of critical importance for delay sensitive applications, we compare the performance of the end-to-end delay and traffic variance over the fluctuation on the transmission time as key indicators of the QoS that the network may provide. Through extensive simulations with the NS-2 simulator, we show how our ACI-EDCA algorithm outperforms the other two mechanisms we consider.

The objective of this paper is to integrate a multi-hop transmission between WLAN 802.11n and 802.11g IEEE standards, so as to enhance the throughput and reduce the data dropped packet and media access delay which is used in IOT & multimedia applications. In the past decades, Wireless Local Area Network standards were used only for transmission of low bandwidth traffic, but with the ongoing standards such as 802.11n and 802.11g, there is a possibility to transmit high bandwidth traffic, such as video traffic and voice traffic. This paper also analyzes the performance of these IEEE standards with a setup of four different scenarios under the Riverbed modeler 17.5. The network performance for each scenario has been evaluated in terms of data drop packet, MAC delay and throughput using a novel of integrated network.

IEEE 802.11ad specifies a hybrid medium access control (MAC) protocol consisting of contention as well as noncontention-based channel access mechanisms. Further, it also employs directional antennas to compensate for the high freespace path loss observed in 60GHz frequency band. Therefore, it significantly differs from other IEEE 802.11(b/g/n/ac) MAC protocols and thus requires new methods to analyze its performance. In this paper, we propose a new analytical model for performance analysis of IEEE 802.11ad employing a threedimensional Markov chain considering all the features of IEEE 802.11ad medium access mechanisms including the presence of non-contention access and the different number of sectors due to the use of directional antennas. We show that the number of sectors has a high impact on the network throughput. We also show that the MAC packet delay is significantly affected by the duration of the contention period. Our results indicate that a suitable choice of the number of sectors and contention period can illustriously improve the channel utilization and MAC delay performance.

As the widely adopted IEEE 802.15.4 standard exhibited severe drawbacks when used in multi-hop WSN environment, the IEEE Standards Association Board has released a revised version, IEEE 802.15.4e, which includes Time-Slotted Channel Hopping (TSCH) mechanism as the MAC amendment to IEEE 802.15.4. The key feature of IEEE 802.15.4e TSCH mechanism is to allow the sensors to plan the time-slot schedule for efficient data transmission. However, the standard does not specify how to plan a time-slot schedule so that data collected by the sensors can be received by the base station as soon as possible without being delayed by transmission conflicts. In this paper, we propose a constant-time, distributed time-slot scheduling algorithm to address this problem. Existing works on IEEE 802.15.4e TSCH scheduling depend on one or a few nodes to collect traffic-flow information from their descendants and plan a centralized time-slot schedule for the whole network. In contrast, our algorithm allows every sensor node to compute its time-slot schedule in a simple, truly distributed manner. Simulation results show that our algorithm significantly outperforms a state-of-the-art protocol in terms of the packet transmission delay and yields a smaller duty cycle. HighlightsThe current state of the art of IEEE 802.15.4e standard is reviewed.The minimum TSCH schedule for conflict-free data gathering process in an IEEE 802.15.4e WSN is shown to be NP-hard.A constant-time, distributed scheduling algorithm to address the minimum IEEE 802.15.4e TSCH scheduling problem is proposed.

This article gives an overview of the IEEE 802.15.10 standard specifying a layer 2 routing (L2R) protocol enabling communication over multiple hops in IEEE 802.15.4 networks. IEEE 802.15.4 is expected to be a predominant technology as we move toward an increasingly interconnected society. IEEE 802.15.10 allows increasing the range of an IEEE 802.15.4 network while maintaining low-power transmission. This new standard is suitable for applications such as smart metering, intelligent transportation systems, and automation, where a varying number of devices are deployed in an area ranging from a few square meters to entire cities or countries.

IEEE 1609.4 suite in WAVE is responsible for the multi-channel operation in VANET. This layer supports better QoS but requires synchronization. They follow a fixed duration for control and service channels that may result in inefficient utilization of channels. In this paper, an asynchronous multi-channel MAC scheme allowing simultaneous transmission on different service channels is proposed. The proposed scheme allows those nodes to dynamically access control channel and also allows them to listen and utilize the control channel while not associated with the service channel. The scheme is compared with IEEE 1609.4 in terms of throughput and channel utilization

Frame resolution and physical layer (PHY) protocol type detection are the basis of research and development of intrusion prevention systems for IEEE 802.11 wireless network. Aiming at the problems which cannot be solved by the specifications export, this paper proposed a MAC frame analytical method and a PHY protocol type detection algorithm based on parsing the IEEE 802.11packets captured by the library Libpcap. The packet structure and the length of the frame preamble (18 or 26 bytes) are presented. Then the methods of transforming byte-order and resolving sub-fields are given. A detection algorithm of PHY protocol type is proposed based on the experiments and examples are given to verify these methods. This work can be a reference for the R & D related to link layer frame analysis.

The DCF (Distributed Coordination Function) is the basic MAC (Medium Access Control) protocol of IEEE 802.11 wireless LANs and compatible with various IEEE 802.11 PHY extensions. The performance of the DCF degrades exponentially as the number of nodes participating in the DCF transmission procedure increases. To deal with this problem, we propose a simple, however efficient modification of the DCF by which the performance of the DCF is greatly enhanced.

With the ever-increasing range of video and audio applications in portable handheld devices, demand for high throughput in Wi-Fi networks is escalating. In this paper we introduce several novel features defined in next generation WLAN, termed as IEEE 802.11ax standard, and compare between the maximum throughputs received in IEEE 802.11ax and IEEE 802.11ac in a scenario where the AP continuously transmits to one station in the Single User mode. The comparison is done as a function of the modulation/coding schemes in use. In IEEE 802.11ax we consider two levels of frame aggregation. IEEE 802.11ax outperforms IEEE 802.11ac by about 29% and 48% in reliable and unreliable channels respectively.

This paper proposes a unified medium access control (MAC) design methodology and presents the implementation of the IEEE 802.11ac down-link multi-user multi-input and multi-output wireless local area network MAC using the proposed design methodology. The proposed methodology employs unified code for both network simulation and system implementation. Because the unified code closely relates these two processes, the performance of the implemented MAC system can be estimated before implementation. The MAC architecture for an access point implemented using the proposed design methodology is verified on an ARM-based platform, and it is applied to a 65 nm CMOS library.

Mobile devices such as smartphones and tablet PCs are increasingly used for business purposes. However, the trustworthiness of the operating system and apps is controversial. They can constitute a threat to corporate networks and infrastructures, if they are not audited or monitored. The concept of port-based authentication using IEEE 802.1X restricts access and may provide statistical data about users entering or leaving a network, but it does not consider the threat devices can pose if they have already been authenticated and used. Security information and event management (SIEM) software has to incorporate information about mobile devices during their usage. Those devices have to gather and publish information to make this possible. This can be achieved by using a client on the mobile device, which is proposed here. It collects metadata including information about device specific data, platform or system state, which is sent via multiple supported protocols to a central SIEM component, where the data is analyzed in assessment procedures for threat analysis by using artificial intelligence and rule-sets.

8021x based authentication enables node devices in network to perform AAA operation (Authentication, Authorization and Accounting) [5]. Authentication is made possible by a handshake mechanism between the node device and the CPE connected by means of a challenge of request/response exchange. The node device sends out a challenge request for which the CPE is expected to respond with an appropriate response message. On reception of a valid expected response from the CPE the node device processes and allows further traffic from the CPE to proceed further. The issue of interoperability comes in to picture when the CPE connected to the node device is not capable of responding to the challenge request sent by the node device to authenticate the CPE. The node device will consider this as an authentication failure and blocks further traffic from the CPE on that port which will render 8021x authentication not feasible for the port where the CPE is connected. This will force the operator to disable 8021x authentication on the port to support interoperability with the CPE connected. When the node device has a mix of 8021x supported and 8021x unsupported CPE’s connected the operator can only enable 8021x authentication for the port’s connected to CPE’s supporting 8021x authentication and not on the ports connected to 8021x unsupported CPE’s. This will cause inconsistency in the system in terms of security as some ports will be left unauthenticated. The solution to this interoperability inconsistency can be obtained by the process of Eligible To Learn (ETL), where a MAC can be configured as ETL on the port. On receiving a packet on the port with a MAC configured as ETL the node device will process the packet irrespective of the 8021x authentication status. This will provide an option for the operator where he can enable 8021x authentication for the entire system and for the ports which are connected to CPE’s which are not capable of performing authentication handshake, the operator can configure the device MAC as ETL. This will remove the authentication inconsistency in the system, providing 8021x interoperability solution

Software-defined networking SDN is a relatively new approach in network management that proposes to separate the network control Control plane and the forwarding process Data plane to optimize the network infrastructure and improve network performance, controllability, manageability and flexibility. However, like every technology, SDN has brought its own new challenges in terms of security and scalability which are very important aspects that should be considered to design and build a resilient architecture in order to meet carrier grade network requirements. In this paper, we propose a secure SDN architecture with IEEE 802.1X port-based authentication where we also consider the controller's scalability issue by devolving the access control capability to the data plane. In this way, we reduce the high demand and the workload on the SDN controller. Our proposed model presents a novel SDN network architecture and logical network segmentation which provides an optimal and secure network access with low latency. We have implemented and tested our architecture to show its performance authentication delays. Copyright © 2016 John Wiley & Sons, Ltd.

IEEE 802.11-based wireless networks are becoming more popular, and a lot of research is done to enhance the performance of the distributed control function (DCF) found in the IEEE 802.11 standard. Many researchers utilized jamming to further enhance the performance of the contention resolution in DCF. However, jamming-based protocols follow elimination schemes based on the use of jam signals which add to the complexity of wireless devices, add new types of errors like falsely detecting noise as a jam, and are not compatible with the IEEE 802.11 standard. In this paper we propose a self-elimination MAC protocol, called SEMP, for wireless networks to achieve a high performance like that of jamming-based protocols but without the use of jamming signals. SEMP requires no changes to the IEEE 802.11 physical layer, is fully compatible with the IEEE 802.11 wireless devices, and is designed to work without any prior knowledge of the number of nodes. Through extensive simulation, we evaluate SEMP and compare it to the IEEE 802.11 DCF and CONTI (a jamming-based protocol that was shown to highly improve the performance of the IEEE 802.11 wireless networks). Simulation results demonstrate that SEMP outperforms the IEEE 802.11 DCF in terms of the throughput, delay, fairness, and jitter. In addition, results show that SEMP provides throughput and delay gains over CONTI, and that both schemes have comparable fairness and jitter measures. Hence, results reveal that SEMP actually does achieve a high performance like CONTI even though no jamming is used.

Recently, as IoT (Internet of Things) becomes more important, low cost implementation of sensor nodes also becomes critical issues for two well-known standards, IEEE 802.15.4 and IEEE 802.15.6 which stands for WPAN (Wireless Personal Area Network) and WBAN (Wireless Body Area Network), respectively. This paper presents the area-optimized AES-CCM (Advanced Encryption Standard - Counter with CBC-MAC) hardware security engine which can support both IEEE 802.15.4 and IEEE 802.15.6 standards. First, for the low cost design, we propose the 8-bit AES encryption core with the S-box that consists of fully combinational logic based on composite field arithmetic. We also exploit the toggle method to reduce the complexity of design further by reusing the AES core for performing two operation mode of AES-CCM. The implementation results show that the total gate count of proposed AES-CCM security engine can be reduced by up to 42.5% compared to the conventional design.

To cope with the increasing demand of multimedia applications, new IEEE 802.11 wireless local area networks devices have been defined such as IEEE 802.11aa and IEEE 802.11ac. The former proposes new intra-access categories (AC) differentiation based on stream classification service (SCS) scheme. The latter standard allows simultaneous downlink transmissions thanks to downlink multi-user MIMO technology and sharing transmission opportunity (TXOP) period scheme. In this paper, we focus on the basis of this technique and the behavior of the access point (AP) to manage the multi-user access. Then, we propose a hybrid access mechanism entitled multi-user multi-cast access mechanism (MUMAM) that supports downlink multi-user transmissions while considering intra-AC differentiation. MUMAN considers SCS scheme to prioritize between multicast and unicast flows of an AC and follows transmissions based on IEEE 802.11ac TXOP sharing technique. Extensive simulation and analysis show that MUMAM has a significant positive impact on delay and throughput performance of different AC(s).