Wimax standards and Security The Wimax

Plaintext payload

CRC

TEK from SA
Key

Generic MAC header

MAC SDU (service data unit) Cyphertext payload

CRC

EC = 1 and EKS indicates the index of the using TEK
CRC adjusts to the changes of GMH and payload

FIGURE 12.8
WiMAX MPDU encryption process. DES-CBC: Data encryption standard with cipher block changing; EC: Encryption control, IV: Initialization vector; EKS: Encryption key sequence; TEK: Traffic encryption key; GMH: Generic MAC header.

block changing (DES-CBC) encryption enciphers the MPDU payload field. Neither the header nor the CRC is encrypted to support diverse services.

As exemplified in Figure 12.8, when the security sublayer generates an MPDU, it checks the SA associated with the current connection and acquires the initialization vector (IV). The MPDU IV is generated by XORing the SA IV with the synchronization field in the PHY frame header. The DES-CBC algorithm then encrypts the MPDU plaintext payload by employing the gen- erated MPDU IV and the authenticated TEKs. The encryption control (EC) field of the MAC header is set to 1 to indicate that the payload in the MPDU is encrypted. The 2-bit encryption key sequence (EKS) indicates which TEK is used. The CRC field is updated in accordance with the changes in both the payload and MAC header.

5. 
   Challenges
   

PKMv1 uses a client/server model for traffic key management, where an SS is the client, requesting keying material, and a BS is the server, responding to the requests. The major challenge comes from the unilateral authentica- tion. PKMv1 ensures that individual SS clients receive only keying material authorized by the BS, i.e., the BS authenticates an SS during each process but not vice versa. This implies that an SS is not capable of detecting a rogue BS. As discussed in Section 12.2, the impact of a rogue BS includes identity theft, degraded throughput, and even service termination. PKMv2 overcomes this by introducing mutual authentication, enabling the SS to authenticate the BS as well [10–12]. The mutual authentication process and other new features of PKMv2 will be elaborated in Section 12.4.

3.