WO2003023982A2 - Securite de transmission pour reseaux locaux sans fil - Google Patents
Securite de transmission pour reseaux locaux sans fil Download PDFInfo
- Publication number
- WO2003023982A2 WO2003023982A2 PCT/US2002/029234 US0229234W WO03023982A2 WO 2003023982 A2 WO2003023982 A2 WO 2003023982A2 US 0229234 W US0229234 W US 0229234W WO 03023982 A2 WO03023982 A2 WO 03023982A2
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- varying
- waveform parameters
- transmitter
- waveform
- demodulation
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04K—SECRET COMMUNICATION; JAMMING OF COMMUNICATION
- H04K1/00—Secret communication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/03—Protecting confidentiality, e.g. by encryption
- H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W84/00—Network topologies
- H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
- H04W84/10—Small scale networks; Flat hierarchical networks
- H04W84/12—WLAN [Wireless Local Area Networks]
Definitions
- the present invention relates to network security, and more particularly, to methods and systems for providing transmission security on wireless communications systems such as wireless LANs.
- TRANSEC refers to any modification or variance of the transmitted waveform that is operative to degrade the performance of a receiver trying to demodulate the transmitted waveform, when the receiver is not cognizant of the modifications or variances. A receiver cognizant of the modifications or variances can compensate so as to avoid any such degradation. Since TRANSEC thwarts demodulation by unauthorized parties, it also strengthens the various data-level encryption measures by denying the ability to collect cipher text for cryptanalysis or the ability to exploit network control information.
- short (40-bit) encryption keys were specified in the 802.11 standard for WEP link-level encryption. With the relaxation of Government control of cryptographic products, these keys will be lengthened, and even the algorithms themselves may be strengthened. However, this encryption is applied only to data payloads, while all control fields remain in the clear in the standard.
- the 802.11 Direct-Sequence Spread-Spectrum (DSSS) standards employ only a single spreading code. Since TRANSEC in conventional DSSS systems requires spreading-code changes unpredictable by unauthorized users, there is no capability in 802.11 DSSS for such TRANSEC. As a result, numerous attacks against 802.11 DSSS equipment exists because the waveforms can be demodulated and/or mimicked at will by malicious parties.
- DSSS Direct-Sequence Spread-Spectrum
- Non-spread-spectrum transmissions are used in higher-rate standards, e.g., OFDM is presently used in 802.11a and HiperLAN 2, and is being considered for others.
- Frequency-Hopping Spread-Spectrum (FHSS) standards include a measure of TRANSEC.
- FH frequency hopping
- the determination of the hop sequence and timing presents a substantial barrier to tampering and/or eavesdropping compared to the DSSS standards.
- the low emphasis of TRANSEC in existing standards, combined with removal of regulatory requirements for using spread-spectrum modulations in traditional spread-spectrum bands will result in future systems whose only protection is link-level encryption of data payloads.
- DSSS transmission In DSSS transmission, the use of a spreading sequence known only to authorized users makes demodulation of transmission by others impossible. Similarly, unauthorized parties cannot generate packets that would be demodulated by valid users.
- One embodiment of the invention incorporates TRANSEC into non-spread-spectrum links (or deficient DS links such as IEEE 802.11b) by introducing variations of physical waveform parameters that can readily be compensated by intended users who are cognizant of the variations, but not by unauthorized parties.
- the parameter variations may pertain to preamble detection, acquisition of phase and/or timing, or to the data modulation itself. Denial to unauthorized parties of any of these parameters regarding aspects of transmission would prevent demodulation of a packet, and could properly be referred to as TRANSEC measures.
- waveform parameter variations can be directed at producing a variety of effects if the parameter variations are left uncompensated at the receiver, h one embodiment, the waveform pattern variations cause a modest number of data errors at the receiver sufficient to cause a packet to fail CRC check; this normally results in the packet being discarded by the MAC layer, and may be sufficient to protect against unsophisticated attacks.
- embodiments of the invention introduce pattern variations that cause total failure of demodulation at the receiver so that forced downloading of damaged packets provides little useful information.
- Representative TRANSEC measures utilized by embodiments of the invention include, but are not limited to: • Modification of the whitening/scrambling sequence to cause data errors
- TRANSEC measures listed above are (1) those which disrupt the modulation process itself (e.g., degrading phase or timing information), as well as (2) those which confuse the various mappings of information to modulation parameters (e.g., assignment of bits to carriers in orthogonal frequency division multiplexing (OFDM — 802.11a) or to waveforms in complementary code keying (CCK — 802.11b), assignment of bits of constellation points in QAM, etc.)
- OFDM orthogonal frequency division multiplexing
- CCK — 802.11b complementary code keying
- the distortion of information preferably include MAC-level control fields normally not protected by link level encryption in present standards.
- the Wired Equivalency Privacy (WEP) protocol may be used in IEEE 802.11 standard networks to protect link-level data during wireless transmission.
- WEP Wired Equivalency Privacy
- the sender encrypts the content of a data frame, but leaves the MAC header in the clear.
- a non-linear scrambling of the bit stream applies to the entire MAC frame, including the MAC header. This protection of control fields provides a new level of protection compared to prior art wireless LANs.
- the TRANSEC measures described herein provide security because authorized users possess the information required to compensate for the distortions introduced, whereas others do not.
- desired users must share information regarding the timing and parameter values used at the transmitter, which must be subsequently compensated at the receiver. For example, if a phase discontinuity is introduced to cause a severe transient in the phase-tracking circuit if uncompensated, then the intended receiver must anticipate where this phase jump will occur relative to a reference time (e.g., frame sync) as well as knowing the phase-jump value. If there were four possible timings and three possible phase-jump values for the transient, then an unauthorized party must guess which of twelve combinations was used in order to compensate.
- the system design is such that intended users have this TRANSEC information in advance.
- Means for distributing TRANSEC information are well-known for DSSS systems. Intended users generally share some form of secret key information: this may or may not be combined with timing information, some field in the Physical Layer (PHY) header (or equivalent collateral information), or even with some or all of the actual data payload.
- PHY Physical Layer
- intended users are able to generate the same randomized parameters at transmitter and receiver such that TRANSEC variations can be removed at the receiver.
- the invention comprises a method of incorporating TRANSEC in a wireless LAN system that includes at least one transmitter and at least one receiver for communicating a transmitted waveform characterized by one or more waveform parameters.
- the method includes selecting at least one of the waveform parameters, preferably below the MAC level, to be varied.
- the method further includes varying, at the at least one transmitter, the one or more selected waveform parameters according to a predetermined parameter profile.
- the method also includes configuring a demodulation process at the at least one receiver so as to compensate for the varying of the one or more selected waveform parameters.
- a receiver not cognizant of the predetermined parameter profile incurs a demodulation performance degradation of the transmitted waveform as a result of varying the one or more selected waveform parameters.
- Another embodiment further includes varying the one or more selected waveform parameters so as to affect the demodulation process at the PHY level.
- Another embodiment further includes varying the one or more selected waveform parameters so as to induce variations in waveform phase information required for demodulation.
- Another embodiment further includes varying the one or more selected waveform parameters so as to induce variations in waveform timing information required for demodulation.
- Another embodiment further includes varying the one or more selected waveform parameters so as to deny access to information relating to a PHY preamble.
- Another embodiment further includes varying the one or more selected waveform parameters so as to affect a mapping from a demodulation decision to a final information format.
- Another embodiment further includes scrambling a serial data stream at the transmitter after a standard scrambling operation at the physical layer.
- Another embodiment further includes scrambling the serial data stream so as to scramble an entire MAC frame encapsulated within a PHY frame.
- Another embodiment further includes mapping a serial data stream at the transmitter to one or more OFDM carriers.
- Another embodiment further includes mapping a serial data stream at the transmitter to one or more transmitter waveforms.
- the invention comprises a system for incorporating TRANSEC in a wireless LAN architecture that includes at least one transmitter and at least one receiver for communicating a transmitted waveform characterized by one or more waveform parameters.
- the system includes means for selecting at least one of the waveform parameters, preferably below the MAC level, to be varied.
- the system further includes means for varying, at the at least one transmitter, the one or more selected waveform parameters according to a predetermined parameter profile.
- the system also includes means for configuring a demodulation process at the at least one receiver so as to compensate for the varying of the one or more selected waveform parameters.
- a receiver not cognizant of the predetermined parameter profile incurs a demodulation performance degradation of the transmitted waveform as a result of varying the one or more selected waveform parameters.
- the means for varying the one or more waveform parameters affects the demodulation process at the PHY level.
- the means for varying the one or more waveform parameters induces variations in waveform phase information required for demodulation.
- the means for varying the one or more waveform parameters induces variations in waveform timing information required for demodulation.
- the means for varying the one or more waveform parameters is operative to deny access to information relating to a PHY preamble.
- the means for varying the one or more waveform parameters is operative to affect a mapping from a demodulation decision to a final information format.
- the means for varying the one or more waveform parameters scrambles a serial data stream at the transmitter after a standard scrambling operation at the physical layer.
- the means for varying the one or more waveform parameters scrambles the serial data stream so as to scramble an entire MAC frame encapsulated within a PHY frame.
- the means for varying the one or more waveform parameters maps a serial data stream at the transmitter to one or more OFDM carriers.
- the means for varying the one or more waveform parameters maps a serial data stream at the transmitter to one or more transmitter waveforms.
- the predetermined parameter profile uniquely corresponds to a key.
- the key includes a code word, a time of day, or a combination thereof.
- access to the key is limited to the at least one transmitter and the at least one receiver.
- the means for varying the one or more waveform parameters predicates the variation of the one or more waveform parameters upon a field in a serial data stream being transmitted via the transmitted waveform.
- the invention comprises a system for incorporating TRANSEC in a wireless LAN architecture that includes at least one transmitter and at least one receiver for communicating a transmitted waveform characterized by one or more waveform parameters.
- the system includes a TRANSEC specification module for selecting at least one of the waveform parameters, below the MAC level, to be varied.
- the system also includes a parameter processor for varying, at the at least one transmitter, the one or more selected waveform parameters according to a predetermined parameter profile.
- the system also includes a demodulation processor for configuring a demodulation process at the at least one receiver so as to compensate for the varying of the one or more selected waveform parameters.
- a receiver not cognizant of the predetermined parameter profile incurs a demodulation performance degradation of the transmitted waveform as a result of varying the one or more selected waveform parameters.
- FIG. 1 A shows a block diagram of the modulation functions that a typical prior art transmitter performs within a network operating according to the IEEE 802.1 la standard;
- FIG. IB shows a block diagram of the modulation functions that a typical prior art transmitter performs within a network operating according to the IEEE 802.1 lb standard;
- FIG 2 shows components for applying TRANSEC in an existing wireless LAN system
- FIG. 3 shows, in block diagram form, an apparatus for assuring temporal variation in the non-linear scrambling of FIG. 2;
- FIG. 4 shows an embodiment that examines the SERVICE field of the incoming data in order to determine whether or not to apply the non-linear scrambling for TRANSEC; and,
- FIG. 5 shows one embodiment of a system for incorporating TRANSEC into an existing wireless LAN architecture according to the present invention.
- FIG. 1 A shows a block diagram of the modulation functions 100 that a typical prior art transmitter performs within a network operating according to the IEEE 802.1 la standard.
- FIG. IB shows a block diagram of the modulation functions 102 that a typical prior art transmitter performs within a network operating according to the IEEE 802.11b standard.
- FIG. 1 A shows a module 104 for providing a processor interface, followed by a second module 106 for whitening (i.e., scrambling) the incoming bit stream, and followed by a third module 108 for applying a forward error correction (FEC) algorithm to the bit stream.
- the IEEE 802.1 la modulation functions 100 further include a fourth module 110 for mapping the bit stream from the third module into bit groups, fifth module 112 for assigning bit groups to proper carrier signals, a sixth module 114 for mapping the bit groups to carrier complex amplitudes, a seventh module 116 for further mapping the bit stream to bit groups, and an eighth module 118 for applying an IFFT to the bit groups.
- FIG. IB shows a module 120 for providing a processor interface, followed by a second module 122 for whitening the incoming bit stream.
- the IEEE 802.1 lb modulation functions 102 further include a third module 124 for mapping the bit stream into bit groups, followed by a fourth module 126 for mapping the bit groups to phase and waveforms.
- FIGs. 1 A and IB the blocks with shading depict those functions that are typically difficult to readily modify.
- One preferred embodiment of the invention therefore effects the TRANSEC measures as simply as possible for a given level of protection.
- One such embodiment for applying TRANSEC in wireless LANs includes a mapping module 130 that operates on the serial stream of bits at the modulator, after the standard scrambling operation 132, as shown in FIG 2.
- the standard scrambling operation 132 corresponds to the second module 106 of FIG. 1A, and the second module 122 of FIG. IB.
- the mapping module 130 applies a non-linear scrambling process to the serial stream, although other embodiments may incorporate other transformative mappings known in the art to the serial data stream.
- the non-linear scrambling process of the mapping module 130 in FIG. 2 is preferably a pseudo-random sequence based on a pre-determined key code, time of day, or both, that can be repeated by an intended receiver to compensate for the mapping (i.e., remove the pseudo-random sequence). This approach minimizes the changes necessary to existing subsystems on both the transmitter and receiver ends of the wireless network.
- the modem may need to access some portions of the serial stream (e.g., PHY header information), the modem would most naturally access this data prior to the scrambling operation, while the information is in its original, raw format.
- operating on the serial stream e.g., applying a non-linear scrambling
- FIG. 3 shows, in block diagram form, an apparatus 200 for assuring temporal variation in the non-linear scrambling of FIG. 2, according to one embodiment.
- the upper part 202 of the FIG 3, a non-time varying configuration simply employs a key to seed a cipher stream generator 204, the output of which is then combined with the standard-scrambled stream 206.
- the use of a stream cipher and the combination by exclusive-or function as shown are only examples; generally the non-linear scrambling operation can take on many forms known in the art.
- the principal aspect of the apparatus 200 shown in the lower part of FIG 3 is that some, or all, of the input stream 208 (e.g., the PHY header and or MAC frame) can be used to alter the characteristics of the non-linear scrambling operation 210.
- an intermediate function block may be used to analyze the input stream 208 and selectively pass only certain portions of the input stream 208 to the non-linear scrambling operation 210.
- Some embodiments of the invention may analyze particular fields of the incoming serial data stream to determine whether or not to vary a particular waveform parameter for TRANSEC. For example, FIG.
- FIG. 4 depicts an embodiment that examines the SERVICE field of the incoming data via a pattern match module 220 in order to determine whether or not to apply the non-linear scrambling for TRANSEC.
- This enables truly standard frames (with respect to prior-art network standards) to be interspersed with TRANSEC-protected frames in normal use.
- the pattern-matching function would be made programmable, under firmware control, so that future use of the SERVICE field could be accommodated.
- the SERVICE (or other such) field contains a pattern enabled for TRANSEC, then the non-linear scrambling operation is used; otherwise, the non-linear scrambling is disabled. This mechanism could also be used to enable/inhibit additional or alternative TRANSEC measures as described herein.
- the SERVICE field detection is shown with a non-time varying non-linear scrambling configuration, as described in FIG. 3.
- FIG. 5 shows one embodiment of a system 300 for incorporating TRANSEC into an existing wireless LAN architecture according to the present invention.
- the TRANSEC specification module 302 receives user input regarding the desired level of security and translates the user input into values related to the waveform parameters. Such values may include which parameters are to be varied, minimum/maximum values, thresholds, time durations, etc., and combinations thereof.
- the input to the TRANSEC specification module 302 may include a key, which would also be distributed to all desired recipients of the transmitted waveform.
- the key may include a code word, a time of day, or a combination of the both.
- the TRANSEC specification module 302 provides the values related to the waveform parameters to the parameter processor 304, which interfaces to the existing modulation functions 306 of the transmitter, and implements the actual parameter variations to the transmitted waveform.
- the parameter processor 304 may include, for example, the component or components necessary to perform non-linear scrambling on the serial bit stream at the modulator, after the standard scrambling operation described herein.
- Each receiver within the network includes a demodulation processor 308 for configuring and coordinating the demodulation functions at the receiver.
- the demodulation processor interfaces to the existing demodulation functions 310 of the receiver, and is operative to remove the effects of the waveform parameter variations effected by the transmitter. For simplicity, FIG.
- each receiver may also include a TRANSEC specification module similar to the one shown for the transmitter, for converting the key into values suitable for the demodulation processor 308.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Mobile Radio Communication Systems (AREA)
- Small-Scale Networks (AREA)
Abstract
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
AU2002326911A AU2002326911A1 (en) | 2001-09-13 | 2002-09-13 | Transmission security for wireless lans |
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US60/322,094 | 2001-09-13 | ||
US32514801P | 2001-09-26 | 2001-09-26 | |
US60/325,148 | 2001-09-26 | ||
US32209401P | 2001-11-21 | 2001-11-21 |
Publications (2)
Publication Number | Publication Date |
---|---|
WO2003023982A2 true WO2003023982A2 (fr) | 2003-03-20 |
WO2003023982A3 WO2003023982A3 (fr) | 2003-06-05 |
Family
ID=26983254
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2002/029234 WO2003023982A2 (fr) | 2001-09-13 | 2002-09-13 | Securite de transmission pour reseaux locaux sans fil |
Country Status (2)
Country | Link |
---|---|
AU (1) | AU2002326911A1 (fr) |
WO (1) | WO2003023982A2 (fr) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
RU2711211C1 (ru) * | 2019-05-07 | 2020-01-15 | Федеральное государственное бюджетное образовательное учреждение высшего образования "Владимирский Государственный Университет имени Александра Григорьевича и Николая Григорьевича Столетовых" (ВлГУ) | Устройство защиты акустической информации от высокочастотного навязывания по радиоканалу |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5455863A (en) * | 1993-06-29 | 1995-10-03 | Motorola, Inc. | Method and apparatus for efficient real-time authentication and encryption in a communication system |
US6252910B1 (en) * | 1998-11-11 | 2001-06-26 | Comspace Corporation | Bandwidth efficient QAM on a TDM-FDM system for wireless communications |
US6438367B1 (en) * | 2000-11-09 | 2002-08-20 | Magis Networks, Inc. | Transmission security for wireless communications |
-
2002
- 2002-09-13 WO PCT/US2002/029234 patent/WO2003023982A2/fr not_active Application Discontinuation
- 2002-09-13 AU AU2002326911A patent/AU2002326911A1/en not_active Abandoned
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5455863A (en) * | 1993-06-29 | 1995-10-03 | Motorola, Inc. | Method and apparatus for efficient real-time authentication and encryption in a communication system |
US6252910B1 (en) * | 1998-11-11 | 2001-06-26 | Comspace Corporation | Bandwidth efficient QAM on a TDM-FDM system for wireless communications |
US6438367B1 (en) * | 2000-11-09 | 2002-08-20 | Magis Networks, Inc. | Transmission security for wireless communications |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
RU2711211C1 (ru) * | 2019-05-07 | 2020-01-15 | Федеральное государственное бюджетное образовательное учреждение высшего образования "Владимирский Государственный Университет имени Александра Григорьевича и Николая Григорьевича Столетовых" (ВлГУ) | Устройство защиты акустической информации от высокочастотного навязывания по радиоканалу |
Also Published As
Publication number | Publication date |
---|---|
AU2002326911A1 (en) | 2003-03-24 |
WO2003023982A3 (fr) | 2003-06-05 |
AU2002326911A8 (en) | 2003-03-24 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7415043B2 (en) | Code division multiple access (CDMA) method and apparatus for protecting and authenticating wirelessly transmitted digital information | |
US7684568B2 (en) | Encrypting data in a communication network | |
US7904723B2 (en) | Method and apparatus for enhancing security of wireless communications | |
US20050220322A1 (en) | Watermarks/signatures for wireless communications | |
US6683955B1 (en) | Method for receiving a secured transmission of information through a plurality of frequency orthogonal subchannels | |
WO2006116579A2 (fr) | Procede et dispositif permettant de securiser des communications sans fil | |
US20060147041A1 (en) | DES algorithm-based encryption method | |
Rahbari et al. | Friendly CryptoJam: A mechanism for securing physical-layer attributes | |
JP4981802B2 (ja) | 通信ネットワークにおけるデータの暗号化 | |
WO2003023982A2 (fr) | Securite de transmission pour reseaux locaux sans fil | |
US6501841B1 (en) | Method for providing security for a transmission of information through a plurality of frequency orthogonal subchannels | |
Kalokidou et al. | LoRaWAN Performance Evaluation and Resilience under Jamming Attacks | |
Li et al. | A Wireless Covert Communication System: Antenna Coding and Achievable Rate Analysis | |
Chang et al. | Redundancy offset narrow spectrum: Countermeasure for signal-cancellation based jamming | |
Wang et al. | Security analysis for ieee802. 11 | |
Risley et al. | Electronic security risks associated with use of wireless, point-to-point communications in the electric power industry | |
JP3957658B2 (ja) | マルチキャリア伝送システム、マルチキャリア伝送装置 | |
Neri et al. | Secure OFDM-UWB communication based on phase hopping | |
DE102004013884B4 (de) | Gesichertes Spread-Spectrum-Nachrichtenübertragungssystem | |
CN111756470A (zh) | 一种基于伪随机序列的噪声调制方法 | |
WO2010056756A2 (fr) | Procédé et appareil de transmission sécurisée améliorée entre des composants de communication sans fil | |
Sasikala et al. | Full Frame Encryption and Modulation Using Friendly CryptoJam Scheme | |
MXPA06007944A (en) | Watermarks/signatures for wireless communications |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A2 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BY BZ CA CH CN CO CR CU CZ DE DM DZ EC EE ES FI GB GD GE GH HR HU ID IL IN IS JP KE KG KP KR LC LK LR LS LT LU LV MA MD MG MN MW MX MZ NO NZ OM PH PL PT RU SD SE SG SI SK SL TJ TM TN TR TZ UA UG UZ VN YU ZA ZM |
|
AL | Designated countries for regional patents |
Kind code of ref document: A2 Designated state(s): GH GM KE LS MW MZ SD SL SZ UG ZM ZW AM AZ BY KG KZ RU TJ TM AT BE BG CH CY CZ DK EE ES FI FR GB GR IE IT LU MC PT SE SK TR BF BJ CF CG CI GA GN GQ GW ML MR NE SN TD TG |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
122 | Ep: pct application non-entry in european phase | ||
NENP | Non-entry into the national phase |
Ref country code: JP |
|
WWW | Wipo information: withdrawn in national office |
Country of ref document: JP |