Abstract Abstract-The IEEE 802.16 technology, commonly referred to as WiMAX, gains momentum as an option for broadband wireless communication access. So far, several research works focus on the security of the 802.16 family of standards. In this context, the contribution of this paper is twofold. First, it provides a comprehensive taxonomy of attacks and countermeasures on 802.16. Each attack is classified based on several factors, e.g. its type, likelihood of occurrence, impact upon the system etc. and its potential is reviewed with reference to the standard. Possible countermeasures and remedies proposed for each category of attacks are also discussed to assess their effectiveness. Second, a full-scale assessment study of indicative attacks that belong to broader attack classes is conducted in an effort to better comprehend their impact on the 802.16 realm. As far as we are aware of, this is the first time an exhaustive and detailed survey of this kind is attempted. I. INTRODUCTION T HE IEEE 802.16 standard was developed to satisfy the growing demand for Broadband Wireless Access (BWA) 1 . Commonly known as the Worldwide Interoperability for Microwave Access (WiMAX), this technology may still fall short in terms of adoption rate when compared to other popular technologies such as IEEE 802.11 [2] . Nevertheless, it is obvious that the more widespread wireless technologies (such as the aforementioned 802.11) are not appropriate for outdoor BWA applications. Thus, WiMAX is expected to be a dominant technology for the Metropolitan Area Networks (MANets) in the near future. Indeed, WiMAX attempts to overcome the last mile bottleneck issue of contemporary telecommunication networks. Among its other assets the support for all-IP core network infrastructure, low latency, advanced Quality of Service (QoS) and sophisticated security prevail. I. INTRODUCTION WiMAX was partially based on the Data Over Cable Service Interface, Baseline Plus Interface (DOCSIS BPI+) protocol [3] which has been originally designed for cable modems. The first version of the standard, i.e., IEEE 802. 16-2001 [4] only supported point-to-multipoint (PMP) fixed wireless access between a Base Station (BS) and several registered Subscriber Stations (SS). Since IEEE 802. 16 Digital Object Identifier 10.1109/SURV.2012.021312.00138 1 A list of acronyms used in this paper are summarized in [1] in the 10-66 GHz frequency range, this technology required line-of-sight (LOS) communication. The next version of the standard namely, IEEE 802. 16-2004 [5] extended the frequency range into the 2-11 GHz band, thus enabling nonlineof-sight (NLOS) communication. Among other improvements in this version mesh mode was introduced. Until now, the most prominent version of the standard, namely IEEE 802.16e-2005 [6] specifies numerous major improvements including the full mobility support. Subscribers are now characterized as Mobile Stations MSs (in the following we use the terms MS and SS interchangeably). This became possible as the standard employs Scalable Orthogonal Frequency Division Multiplexing (SOFDM) in the physical layer. Additionally, it supports advanced security features such as mutual authentication for both the BS and MS. 802.16j-2009 [7] added support for multihop relays. Finally, the latest version of the standard, namely 802.16m-2011 [8] (also known as WiMAX release 2), added support for data rates as high as 100 Mbps for mobile nodes and 1 Gbps for stationary users. As always, security is an essential prerequisite for the success of every communication technology. Wireless communications are by nature more vulnerable to a number of different attacks such as man-in-the-middle, DoS and replay. In the case of WiMAX -which was initially constructed with respect to a protocol for wired environments-, the security provision is rather inefficient as wireless and wired realms enjoy very different threat models. Moreover, with each version of the standard new improvements were added but at the same time new threats emerged. For instance, lower frequencies (and as a result NLOS communication) introduced in IEEE 802. reduce the hardware implementation complexity and the physical placement constraints for an attacker. Similarly, mesh mode is by definition insecure as it assumes the trustworthiness of all nodes of the network. Moreover, the support for mobility, facilitates aggressors to launch attacks from virtually anywhere within the network. The relay station feature, introduced in the 802.16j-2009, announces a new element on the network, but with it, another target of possible attacks is added. The latest version of the standard added improvements in the security mechanisms that include encrypted control messages and a new version of the Privacy and Key Management protocol (PKMv3). However, since this version is very recent and there are no published works to report on the robustness of its security features so far, it will be excluded from this survey. For the same reason attacks against the 802.16j amendment are left out. Nevertheless, it is true that the rest of the amendments of the standard, despite the constant security improvements, maintain 1553-877X/13/$31.00 c 2013 IEEE a considerable number of security inefficiencies, exposing the user and the network to a significant number of threats. I. INTRODUCTION Our Contribution: This work surveys the attacks and countermeasures found in the literature against the IEEE 802. 16 family of standards. The focus is on attacks, feasible against the MAC layer and up to the 802. version of the standard. Thus, attacks against the physical layer of WiMAX, like the ones described in [9] are outside of the scope of this work. Also, this work attempts to organize and classify the possible attacks rather than simply provide an overview of the documented threats like in [10] . For each of them first the vulnerability of the protocol that makes the attack feasible is presented. Next, the attack methodology is thoroughly explained and evaluated based on a number of different criteria. It is stressed that, while a risk analysis of threats in WiMAX has been attempted in the past [11] , [12] , [13] , our work focuses on specific attacks and not generic threat categories. This work also contributes the reproduction of characteristic attacks with special interest in simulation environment. This aims in assessing the potential threat and quantifying the possible risk in a less theoretical level. Finally, proposed remedies for numerous vulnerabilities are presented and evaluated. To the best of our knowledge it is the first time an exhaustive and detailed survey of this kind is attempted. I. INTRODUCTION The remainder of this paper is organized as follows: The next section describes basic concepts of WiMAX architecture including the network structure and security mechanisms. Although this paper assumes a minimum level of familiarization with the mechanisms of 802.16 by the reader, this section is necessary for reasons of completeness. Section III gives an insight, categorizes and surveys attacks against 802. 16 . Section IV presents solutions found in literature for dealing with different categories of WiMAX threats. Section V contains experimental results of some attacks that pose special interest. Finally, in Section VI we conclude. II. WIMAX ARCHITECTURE A. Protocol Stack The IEEE 802.16 protocol is organized primarily in the Physical (PHY) and the Medium Access Control (MAC) layers. The MAC layer can be further divided into three sublayers, namely the Service Specific Convergence Sub-layer (CS), the Common Part Sub-layer (CPS) and the Security Sublayer. CS is the sub-layer that communicates with higher layers to acquire network data. In the process it transforms these data into MAC Service Data Units (SDUs). The format of the CS payload itself is CS depended. A. Protocol Stack CPS provides basically the core MAC functionality being responsible for functions such as bandwidth allocation, connection establishment, and connection maintenance. A. Protocol Stack The Security Sub-layer, addresses procedures such as authentication, authorization, key establishment, distribution and management. Also, it is responsible for encryption and decryption of traffic passing from the PHY to the MAC layer and vice versa. The security mechanisms applied here will be presented in greater detail later in this section. A. Protocol Stack The physical layer allows great flexibility to service providers in matters of cell planning, cost, radio capabilities, B. Network Entry During the Initial network entry many critical parameters are negotiated between the MS and BS. From a security point of view the entire procedure is extremely receptive to violations since for most of its part the security measures contemplated by the specification have not taken place and important negotiation parameters are transmitted in cleartext. This section describes the basic steps that occur during the initial entry of an MS to the network. The overall procedure is summarized in Figure 1 . B. Network Entry Upon initial network entry (or after loss of signal) the first action an MS does is to acquire a DL channel. The MS shall begin scanning the DL frequency band for possible channels of operation until it finds a valid DL signal. This step ends once the PHY has achieved synchronization. B. Network Entry To do so, at least one DL-Medium Access Protocol (DL-MAP) message must be received by the MS. The DL-MAP informs the MS about the DL-Burst Profiles. The MAC remains in synchronization as long as it keeps receiving the DL-MAP and Downlink Channel Descriptor (DCD) messages for the channel. An MS may use the information contained in the DCD to determine if the channel corresponds to its needs. Also, the MS shall search for a Uplink Channel Descriptor (UCD) message from the BS (this is transmitted periodically to all the available UL channels) for retrieving the transmission parameters of a possible UL channel. B. Network Entry After the MS has obtained the UL and DL parameters it will attempt to acquire the correct timing offset and make power adjustments through the process of ranging. The MS shall use the information contained in the UL-MAP (or UCD) message to find an initial ranging interval. Usually, the BS allocates an initial ranging interval consisting of many Transmission Opportunities (TO). For Single Carrier (SC) and OFDM PHY, the MS shall construct an RNG-REQ message. Then the MS can transmit the RNG-REQ message in one of the known TO. Typically, there are only 3 TO in a 5 ms frame thus there is high probability of a collision to occur. To reduce collisions the 802.16 specification dictates that the nodes should pass a period of inactivity of random duration known as Backoff (BO). If a collision occurs, the MS will eventually become aware of it since the corresponding RNG-RSP message will not arrive to the device within the expiration of the T3 timer (set to 200 ms by default). The collided nodes will attempt to resend the RNG-REQ message after a random waiting time but the waiting time interval will be doubled (until a maximum value is reached). This process will repeat (as long as MSs collide) up to a defined maximum number of retries. The aforementioned process is known as Truncated Binary Exponent Backoff (TBEB). B. Network Entry Once the RNG-REQ message has been received by the BS, the latter will construct an RNG-RSP message and send it using the Initial Ranging Connection Identifier (CID). This message exchange shall result in the MS acquiring Basic and Primary Management CIDs as well as information about RF power level adjustment, offset frequency adjustment and timing offset corrections. Figure 2 presents the entire initial ranging procedure. B. Network Entry After ranging has successfully taken place, the MS will send to the BS an SS Basic Capability (SBC)-REQ message to inform it of its basic capabilities. The BS responds with an SBC-RSP message containing only the capabilities both the MS and BS can support. B. Network Entry Upon successful capabilities negotiation, MS authorization and key exchange follows. The details of this procedure are analysed in greater depth in the next section. B. Network Entry Registration is the process that takes place after successful authorization. During this step the MS gets the Secondary Management CID. This means that the MS is actually granted entry into the network. This process involves the exchange of a pair of REG-REQ and REG-RSP messages. When both messages are successfully received, the BS will authorize the MS to forward traffic to the network. B. Network Entry Typically, the MS shall invoke Dynamic Host Configuration Protocol (DHCP) mechanisms for receiving all relative parameters, establishing IP connectivity and obtaining an IP address. The versions of the IP that are supported by the MS are indicated in the REG-REQ message with the default value being IPv4. B. Network Entry Both the MS and BS need to be synchronized as the management system requires the current date and time for time-stamping logged events. For this reason, request and response messages are exchanged with a time server. The MS's secondary management connection is utilized for this process. This step is crucial for ongoing operation although not obligatory for a successful registration. B. Network Entry Next, the MS shall receive the MS Configuration File using Trivial File Transfer Protocol (TFTP) on the secondary management connection. This file consists of a number of configuration settings that are encoded in Type-Length-Value (TLV) format. The MS must notify the BS of successful receipt of this message by transmitting a Configuration File TFTP Complete (TFTP-CPLT) message on the primary management connection. B. Network Entry As a final step, the BS shall send several Dynamic Service Addition (DSA)-REQ messages to the MS for creating new service flows. The MS responds with DSA-RSP messages. C. Security Architecture IEEE 802.16 relies on the Security Sub-layer to provide security to the end-subscriber and the network. This part of the protocol is where all the necessary cryptographic transformations are applied to the MAC PDUs. This is necessary to provide: (a) privacy, confidentiality and authentication to the subscribers, and (b) protection from theft of service to the service providers. C. Security Architecture The basic mechanism of security enforcement in 802.16 is the Privacy Key Management (PKM) protocol. Both 802. and 802.16e-2005 support two versions of the PKM protocol. Mainly, PKM is responsible for authorization of subscribers and distribution of the keying material to the MS. Secondarily, it controls the application of the negotiated encryption algorithms to the data traffic. Actually, the PKM tasks can be divided into three distinct undertakings namely, authentication, key exchange, and encryption with a brief step for the key derivation that takes place in between the authorization and key exchange phases. 1) Authorization: The step of authorization happens first in the PKM protocol. The messages exchanged in this step differ for the two versions of the protocol. In PKMv1 the authorization process is initiated by the Authentication Information message which is sent by the MS to the BS. This message contains the MS manufacturer's X.509 certificate, (the manufacturer may have issued itself this certificate) and it is strictly informative. This message is then followed by an Authorization Request message sent again by the MS to the BS. This is comprised of the following information: (a) The manufacturer-issued X.509 certificate of the MS, (b) a description of the cryptographic capabilities the MS supports, and (c) the MSs Basic CID. The purpose of this message is to request an Authorization Key (AK), and at the same time be assigned with the Security Association Identifiers (SAID) (matching the corresponding Static SAs) that the client has the right to participate in. 1) Authorization: In response, the BS validates the MS's identity and determines the encryption algorithm (among the commonly supported ones), activates an AK for the MS, and constructs an Authorization Reply message. The latter is sent to the MS and it consists of the following fields: (a) the active (for this particular MS) AK which is encrypted with that MSs public key, (b) a 4-bit key sequence number used to distinguish between successive generations of AKs, (c) the lifetime of this key, and (d) the identities (i.e., the SAIDs) and properties of the Primary and Static SAs for which the MS is authorized to obtain keying information. Protocol 1 illustrates the flow of messages and their contents during this step. 1) Authorization: It is obvious that authentication in PKMv1 is one way, meaning that the BS can authenticate the MS but not viceversa. This introduces a vulnerability that soon became the cause of many attacks. As a result, PKMv2 was introduced and the authorization part is slightly modified to support mutual authentication. As in PKMv1, the second version of the PKM protocol dictates that the authorization process must start with the transmission of the informative message Authentication Information. This message is the same as in PKMv1. 1) Authorization: Following the Authentication Information the MS must issue an Authorization Request. The format of this message is modified in PKMv2. The Authorization Request includes: (a) The manufacturer-issued X.509 certificate of the MS, (b) a description of the cryptographic algorithms supported by the MS, (c) the SSs Basic CID, and (d) 64-bit random number generated by the MS. The last field is the only new one added since the original PKM protocol to the Authorization Request message. 1) Authorization: In response, a BS sends back an Authorization Reply message. This message has been rectified more extensively and its fields now include: (a) The BSs X.509 certificate; It is used to verify the BSs identity and to guarantee the authenticity of this message, (b) the pre-PAK key which is encrypted with the MSs public key; Only the owner of the corresponding private key will be able to decrypt it, (c) a 4-bit PAK sequence number, used to distinguish between successive generations of AKs, (d) the PAK lifetime, (e) the identities (i.e., the SAIDs) and properties of the SAs for which the MS is authorized to have keying material, (f) the 64-bit random number generated by the MS, originally contained in the Authorization Request message; This field is included to ensure that the Authorization Reply corresponds to the correct Authorization Request message. Additional fields are: (g) a new 64-bit random number generated by the BS and (h) the RSA signature over the entire message. This allows the MS to verify that the BS is indeed the author of the Authorization Reply message. This process is performed using with the public key of the BS which is acquired by the certificate contained in the message. In other words, this extra field allows for mutual authentication. 1) Authorization: Following the message above the MS replies with an Authorization Acknowledgement message (or an Authentication Reject message in the case where the BS will reject the MS). The Authorization Acknowledgement includes: (a) the 64-bit random number originally contained in the PKMv2 RSAReply message, (b) an Authentication result code which can be "success" or "failure", (c) an Error code which indicates the reason for the reject, (d) an optional Display string which includes a phrase for the reason for the reject rather than just a code number, (e) an RSA signature over the entire message. Protocol 2 Authorization Step of PKMv2 Protocol 2) Key Derivation: After the PKM authentication phase, normally the MS is in possession of some keying material. A small step where the MS derives the appropriate keying material takes place before the PKM can proceed to the next phase. The key derivation process is different between the two versions of the PKM protocol. Actually, the keys in 802.16 form a hierarchy. A key of a higher level is used to produce the key of the immediately lower level. All key generations in PKMv2 are produced using the Dot16KDF function. This function takes 3 arguments: (a) A keying material of a higher level, (b) a string used to alter the output of the algorithm, and (c) a number used to indicate the length of the generated key. Protocol 2 Authorization More specifically, the RSA-based authorization process results in the creation of the pre-Primary Authentication Key (pre-PAK) while the Extensible Authentication Protocol (EAP) based authentication process produces the Master Session Key (MSK). These two keys constitute the basis of all other keying material and they are placed in the top of the key hierarchy. In RSA-based authorization a pre-PAK is used to generate the Primary Authentication Key (PAK). Optionally, the EAP Integrity Key (EIK) can also be generated from the pre-PAK. EIK is used for transmitting authenticated EAP payload. In EAP-based authorization the 512 bits MSK, is simply truncated to 160 bits to derive the Pairwise Master Key (PMK). One of the PAK, PMK or both (according to the authentication method that was used) will be provided as input to the Dot16KDF function to produce the AK. The Key Encryption Key (KEK) is derived directly from the AK. Protocol 2 Authorization Message Authentication Code (MAC) keys are used to sign management messages. This procedure is performed to guarantee the authenticity of these messages. The IEEE 802.16 supports two MAC modes namely Cipher-based MAC (CMAC) and Hashed MAC (HMAC). The one to be used is negotiated during the MS Basic Capabilities negotiation phase. Different MAC keys exist for UL and DL messages. The Cipher-based MAC Key for Uplink (CMAC KEY U) is used for signing messages in the uplink while the Cipher-based MAC Key for Downlink (CMAC KEY D) is used for the same purpose in the downlink. This only applies for the cipherbased MAC mode. For the hash-based MAC mode corresponding keys exist, i.e. HMAC KEY U, HMAC KEY D). In the case of HMAC these keys are derived directly from Dot16KDF function while in the case of CMAC and for versions later than 802.16e a corresponding prekey is generated first (look figure 3 for more details). Also there are different keys for broadcast and unicast messages. In any case, MAC keys are derived directly from AK by simply using different string and key size arguments in the Dot16KDF function for each mode. Figure 3 depicts a diagram of the complete key derivation flow. Protocol 2 Authorization 3) Handshake: The next phase is a three way handshake. It's main role is to confirm that both the MS and BS have indeed the correct AK from the previous procedure. Additionally, the handshake protocol takes care of secondary procedures such as key activation and SA parameters negotiation, security parameters confirmation etc. For this purpose the BS shall send an PKMv2 SA-TEK-Challenge which simply includes: (a) a random number, (b) sequence number for the new AK, (c) the ID of the new AK, (d) Key Lifetime all protected by (e) the HMAC/CMAC. Protocol 2 Authorization The SS shall respond with a PKMv2 SA-TEK-Request to the BS. This message includes: (a) the random number the MS received from the PKMv2 SA-TEK-Challenge, (b) a random number the MS produces, (c) the sequence number of the new AK, (d) the ID of the AK, (e) the cryptographic suites supported by the MS, (f) the security capabilities of the MS, and (g) the HMAC/CMAC of the entire message. Protocol 2 Authorization Upon reception of PKMv2 SA-TEK-Request, a BS first confirms that the AKID contained in the message refers to a valid AK and then it verifies the HMAC/CMAC. After that the BS will check if the random value sent matches the one contained in the PKMv2 SA-TEK-Request. If any of the three aforementioned tests fails the BS will simply ignore the message. Finally, the BS will make sure that the security capabilities encoded in the Security Negotiation Parameters attribute are the same with the security capabilities provided by the MS through the SBC-REQ message. If not, the BS should report the inconsistency to higher layers but might as well accept the message. If the validation of the PKMv2 SA-TEK-Request is successful, the BS shall send a PKMv2 SA-TEK-Response back to the SS. This message includes all the fields of the PKMv2 SA-TEK-Request message plus a TLV list of the SAs, their identifiers (SAID) any additional properties of the SA (e.g., type, cryptographic suite) that the SS is granted access to. The TEK-Parameters attribute in that list contains keying material such as the TEKs remaining key lifetime, its key sequence number and the Cipher Block Channing Initialization Vector (CBC IV). The HMAC/CMAC is the last field of this message. It is to be noted that a unique state machine is maintained by the MS for each SAID contained in the PKM-RSP message. Each state machine is responsible for the initial establishment of TEK as well the periodic refreshing of those keys. Protocol 2 Authorization 5) Traffic Encryption: After successful TEK exchange, both the MS and BS are able to encrypt/decrypt traffic, using this key. Note that the generic MAC header is not included in the encryption. Multiple encryption algorithms are supported. When DES algorithm in CBC mode is used, the CBC IV for the DL, shall be calculated by performing the XOR function to IV parameter included in the PKM-REP message and the current frame number. For the the UL, the CBC IV shall be calculated by performing the XOR function to IV parameter included in the PKM-REP message and the number of the frame where the relevant UL-MAP has been transmitted. If the AES algorithm in CCM mode is used then the MAC PDU payload shall always be prepended with a 4-byte packet number which will never be encrypted. Also, the MAC PDU shall be appended an 8-byte integrity check value which will be included in the encryption. Last, if AES in CBC mode is used then the CBC IV is calculated as the result of the the IV parameter included in the PKM-RSP message XORed with the concatenation of: (a) the 48-bit MAC PDU header, (b) a 32-bit PHY Synchronization value of the MAP that a data transmission occurs, and (c) the XOR value of the 48-bit MS's MAC address and the Zero Hit Counter. The complete sequence of messages exchanged during the PKMv2 protocol is illustrated in figure 4 . III. SURVEY OF ATTACKS In this section we describe existing attacks against the IEEE 802.16 found in literature. The attacks are organized based on their type into several classes. Note that many of the attacks described in the literature are theoretic and we argue that some of them are not feasible under realistic conditions, although the specification does leave a margin for a security breach. Due to the lack of attack naming, we have adopted a custom naming convention to assist the readability of the paper. This naming convention follows the pattern "Message Effect" whenever this is possible. There are 2 cases where the attacks are already named in the original papers so that name was favoured and maintained in this work. A risk analysis for each one of the described attacks is also appended. Table I gathers and presents the attacks that will be described hereunder. We analyse and evaluate the severity of each attack according to a modified version of the methodology presented in [11] , [13] (which in turn is a stricter version of a methodology developed by ETSI [14] ). Specifically, we classify attacks according to the risk they impose to the studied system as: Major, Moderate, Minor. This classification is done by taking into account two factors: III. SURVEY OF ATTACKS 1) Likehood of occurrence -This criterion indicates the possibility of an attack to be implemented by exploiting vulnerabilities of the system. The attack is considered unlikely if its implementation cost is high, major technical obstacles exist, or the risk of the attacker to be exposed is high. An attack is possible if the cost of the attack as well as the risk of exposing herself are moderate and the technical difficulties are solvable. An attack is likely if the associated costs and risks for the attacker are low and there are no technical difficulties associated with the attack. 2) Impact upon the system -This criterion is an indicator for the possible consequences to the system, provided that the attack succeeds. The attack is considered to have low impact if it affects small number of users, for a short amount of time and simply generates commotion to the system. An attack is considered of medium impact if it succeeds to afflict loss of service, affects a larger number of users but still its consequences are reversible. An attack is considered of high impact if it affects a large number of users for a significant amount of time and causes financial losses for the provider or loss of privacy/confidentiality for a user. III. SURVEY OF ATTACKS To formalize the aforementioned model we assume the following sets: Table I contains an evaluation of all the attacks that are going to be discussed in the process of this work according to this model. For all possible Threat, Likehood and Impact values with respect to the aforementioned characteristics the reader should consult the appendix. A. Ranging Attacks As already mentioned, one of the basic steps of initial network entry is ranging. This procedure aims in both BS and MS acquiring the correct timing offset and making the correct power adjustments so that their transmissions are aligned for the chosen physical method. When a ranging transmission opportunity occurs (this info is contained in the UL-MAP message) for the first time, the MS shall send an RNG-REQ message. Once the BS receives a decodable RNG-REQ message, it shall assign Basic and Primary Management CIDs for the MS and commit bandwidth. At the same time, the BS shall calculate any Radio-Frequency (RF) power level, frequency offset as well as any timing offset adjustments necessary for optimal communication. Finally, it will construct an RNG-RSP message with all this information and transmit it using the Initial Ranging CID. These two messages are responsible for the ranging procedure and have similar format. In more detail the RNG-RSP message defines: (a) The Basic and Primary Management CIDs for this SS, (b) Information about RF power level adjustment, (c) Information about offset frequency adjustment, and (d) Information about timing offset corrections. A. Ranging Attacks This information is encoded as TLV fields and since not all fields are mandatory this message has a variable length. If the status of the RNG-RSP message is "success", the initial ranging procedure shall terminate. In case where the Ranging Status field is "continue" the Basic CID shall be used and MS and BS shall continue exchanging RNG-REQ and RNG-RSP messages for fine-tuning the parameters mentioned above. Once the RNG-REQ is within the tolerance threshold of the BS, the MS shall join data traffic in the UL. If the Ranging Status is "abort" then the MS repeats the cycle of initial network entry by scanning for DL frequency. Besides initial network entry, ranging also occurs at predefined time intervals. Periodic ranging allows the MS to adjust its transmission parameters so that it can maintain optimal UL communication with the BS. Periodic ranging may be also initiated by the BS. For this reason the MS should always be able to accept RNG-RSP messages in an unsolicited manner. These messages are not encrypted or integrity protected and they are stateless, i.e. an MS will proceed to actions dictated in an RNG-RSP message if that message is addressed to it and appears to be well-formed. Whatever the case, an attacker may manipulate the ranging messages in many ways to affect single users or the entire network. The relevant attacks found in literature are analyzed below. 1) RNG-RSP DoS Attack: This attack can be addressed to a single target MS or multiple ones. Its methodology is simple enough but the challenge in implementation lies in its high cost. In both cases the aggressor must know the radio channel of the network to be attacked and possess a BS like equipment that will allow him to transmit RNG-RSP messages. Recall that RNG-RSP messages can be transmitted in an unsolicited manner which makes the attack possible. In the first case, the attacker must also know the CID used by the victim MS. This information can easily be sniffed from any (unencrypted) management message exchanged between that specific MS and the BS. After that, the attacker forges an RNG-RSP message with the "Ranging Status" field set to "abort" and sends it to the victim [15] , [16] . This will force the user/victim to disconnect from the network immediately. In the second case, the attacker simply needs to cycle through all 65,536 possible CIDs in a brute force manner, and send one forged RNG-RSP message for each CID. After that the victim device will attempt to reconnect to the network by executing Initial Network entry. Up to this point the effect of this attack is simply annoyance. By repeating this procedure the aggressor can achieve DoS to an even larger number of users, since each attack round forces the MS to a heavy signalling procedures (i.e. Initial Network entry). The DoS effect will continue only as long as the target MS(s) remain inside the influence field of the attacker and she actively and continuously transmits bogus RNG-RSP messages. Take into account that this also increases the risk for the attacker of being detected. A serious attacker might choose to collaborate with others or be on the move to avoid detection. Therefore, this attack is classified as major. 1) RNG-RSP DoS Attack: 2) RNG-RSP Downgrading Attack: An RNG-RSP message can be manipulated in a number of different ways by an attacker aiming to disrupt the normal MS communication. For example, the attacker may alter the RNG-RSP frequency field in order to force the victim MS to shift to another channel. In a typical scenario, the MS will have to rescan many frequencies (wasting 5 ms in each one) until it finds the proper channel. As a consequence, this would disrupt the proper operation of the MS. Similar results can be achieved by shifting only the UL or the DL channel, or by altering other fields of the same message such as the Timing Adjust and Power Level Adjust [17] . 1) RNG-RSP DoS Attack: This attack is quite similar to the RNG-RSP DoS Attack in matters of implementation methodology, implementation difficulty, realization cost, risk and possible effects. Again the attacker can hope for annoyance or even DoS if she is willing to take the analogous risks. Actually, the authors [18] implemented this attack using experimental equipment to demonstrate that when the power level field of the RNG-RSP message is set to minimum, then loss of service (annoyance) occurred for approximately 10 sec. Because the attack methodology is not trivial while there are high costs and risks associated, this attack should be considered a minor one. One interesting modification transforms it to a stepping stone for unleashing more dangerous attacks. For example, a potentially more dangerous scenario would be to shift the victim MS to a frequency where a rogue BS set by the attacker exists. 1) RNG-RSP DoS Attack: 3) RNG-RSP Water Torture Attack: This is a modification to RNG-RSP Downgrading Attack but with totally different focus on the desired effects. An attacker might forge and send an RNG-RSP message with the Power Level Adjust field set to the maximum value. This can force the MS to constantly operate in higher energy requirement state, thus causing a quicker drain of its battery resources [17] . 1) RNG-RSP DoS Attack: Similarly to the already described RNG-RSP Downgrading Attack, this one is easy to implement but has high implementation costs due to its requirements for a special BS like equipment. The two attacks are also similar in methodology. The effects, which are higher battery depletion rate persist for a considerable time. That is until next ranging/periodic ranging. Thus, the risk for the attacker is smaller since she can simply transmit the message and move. On the other hand, the effects of the attack, namely the drain of energy resources are not expected to be dramatic so the attacker can hope for simple annoyance and nothing more. Therefore, an RNG-RSP Water Torture Attack is unlikely to lure serious attackers. Considering all the above, this attack is classified as minor. 1) RNG-RSP DoS Attack: It is to be noted that watertorture attacks are generally considered as physical level attacks. However, despite the fact that this survey focuses on MAC layer attacks, we have chosen to include watertorture attacks in the analysis because the attacker has to exploit vulnerabilities on the MAC plain. 4) RNG-REQ Downgrading Attack: The RNG-REQ message can also be used to inform the BS about the preferred DL burst profile. However, an attacker might take advantage of this. Specifically, by replacing the optimal burst profile with a least effective one the attacker may achieve to downgrade the service [17] , [16] . 4) RNG-REQ Downgrading Attack: The effectiveness of the attack depends on how wellmanipulated the selected burst profile is. This kind of information cannot be easily deduced for any given MS. This limits the attacker to thoroughly work against a specific victim or a small number of target MSs. Also, as already mentioned, the possible outcome of a successful RNG-REQ Downgrading Attack is simply annoyance. Therefore, this attack is considered as minor. 5) RNG-REQ DDoS Attack: In this case a set of collaborating attackers may produce a large number of fake RNG-REQ messages (with different values each time) and simultaneously transmit them to the target-BS in order to waste its resources [19] . Constructing and sending multiple RNG-REQ messages with random fields and fake MAC ID, in contention mode, is not a resource intensive process for an attacker. On the other hand, the response part in the BS side is a multi-step process which consists of allocation of Basic and Primary management CIDs, deciding weather the signal is good enough or any adjustments are necessary, constructing an RNG-RSP etc. 5) RNG-REQ DDoS Attack: A collaborative attack of this kind is expected to cause considerable burden in the BS which will possibly result in lower quality of service or even Distributed DoS (DDoS) for all legitimate MSs connected to the specific target-BS. Actually, when an attacker attempts such an attack she affects the system in many different ways. For example she a) artificially increases the number of collisions in the network, b) imposes burden on the BS by forcing it to conduct the ranging process for a large number of virtually non-existing MSs, and c) tricks the BS into ranging and then committing bandwidth and CIDs to fake MSs. The authors in [19] seem to have focused on the impact of this attack, to the second and third aspect mentioned previously and through simulation experiments they prove that this is a hazardous one. We argue that the most harmful aspect of this attack, is the first one but is surprisingly, neglected in literature. Due to the inefficiencies and bad mechanics of the TBEB algorithm which takes place during initial ranging, the first aspect of the attack can cause havoc to the signaling plane by transmitting extremely low volume of attack traffic. If the aggressor manages to transmit, say an RNG-REQ on every TO of each frame then she will dramatically augment the number of collisions which in turn will lead to a dramatic increase in the access delay. The same mechanism for collision avoidance is applied in the 802.11 and has been target of criticism [20] there too. The work in [21] proposes a mathematical model for the WiMAX which unlike most existing models [22] , [23] for initial ranging, is not based in a stochastic Markov chain. 5) RNG-REQ DDoS Attack: The only real requirement in matters of implementation methodology is the attacker to have control over a small number of programmable MSs and synchronize their actions. The cost of such devices is low. Since at this phase addressing information has not been assigned to the MS (and MAC address field contained in the RNG-REQ can easily be spoofed) the BS has not any means of recognizing the attackers. Additionally, the small attack traffic makes it extremely difficult for external tools such as Intrusion Detection Tools (IDS) to recognize such behaviour as intrusive. Therefore, this attack is classified as major. 6) MOB ASC-REP DoS Attack: It is possible for an MS during its ranging procedure to receive an Association Result Report (MOB ASC-REP) message instead of several RNG-RSP ones. This happens when association level 2 is used. In this case, the RNG-RSP information that is sent by each target BS is gathered to the serving BS over the backbone network. The BS then aggregates all the data from the RNG-RSP messages to a single MOB ASC-REP message which will be transmitted over the Primary Management CID. Since the MOB ASC-REP report messages are unprotected it is possible for an adversary to forge them stating that no services are available from all the target BSs [17] , [24] , [25] . 6) MOB ASC-REP DoS Attack: A MOB ASC-REP DoS Attack will prevent the victim MS from associating with the optimal BS which will be translated as lower QoS for the target MS. This attack assumes that the attacker transmits this kind of messages over a BS like equipment. This automatically increases the implementation costs. The attacker must also know if and when the victim MS maintains level 2 association which increases the complexity of the attack methodology. For this reason also this type of attacks are typically unleashed against a single MS or a small number of MSs. For these reasons it is less likely to be favoured as the attack strategy by a serious aggressor, therefore, it is considered minor. B. Power Saving Attacks The IEEE 802.16e specification introduced support for mobile devices. Since most devices of this type are battery supported, the specification included power-saving features in order to prolong the battery life of MSs. Power Saving Class (PSC) is a concept that defines a group of connections that have similar demand properties. B. Power Saving Attacks Three types of PSC exist: (a) Power saving class of type I which is preferred for connections of Best-Effort (BE), NonReal Time Variable Rate (NRT-VR) type, (b) Power saving class of type II, which is recommended for Unsolicited Grant Service (UGS), Real-Time Variable Rate Service (RT-VR) connections, and (c) Power saving class of type III, which is recommended for multicast connections and management operations. In 802.16 power saving is achieved with the MS functioning in Sleep or Idle mode. Sleep mode is a state during which the MS turns off various functions thus becoming unavailable for pre-negotiated (with the serving BS) periods of time. Sleep mode is characterised by intervals of unavailability and availability in DL or UP. During an unavailability interval, the BS shall not be able to transmit to the MS (or receive from it); therefore, the MS can shutdown several physical operation components. During an availability interval, the MS is expected to receive all transmissions in the DL (or transmit in the UL) normally as in no-sleep state. During this time-frame the MS may verify synchronization with the BS and may participate in periodic ranging. Sleep mode may be initiated by the MS or the BS in a number of different ways depending on the PSC. The MS initiates Sleep mode after an inactivity timeout. To do this it transmits a MOB SLP-REQ message or a BR and UL sleep control header. The BS shall respond to these messages with a MOB SLP-RSP message or a DL sleep control extended sub-header, respectively. A PSC may also be activated in RNG-REQ and RNG-RSP message by the appropriate TLVs. The BS, on the other hand, may force an MS to re-activate a previously defined PSC by transmitting a MOB SLP-RSP or DL Sleep control extended subheader in unsolicited manner. Power saving class becomes active at the frame specified as start frame number for the first sleep window. Thereafter, each sleep window is double the size of the previous one, but not greater than a maximum value. The 802.16 sleep mode process is based on a Binary Truncated Exponent algorithm (BTE) for deciding sleep intervals. This algorithm does not consider the delay of the packets and it has been the center of criticism [26] . The algorithm can be described as: B. Power Saving Attacks The BS transmits a MOB TRF-IND with negative value on each availability interval, thus the MS repeats the sleeping cycle. During unavailability intervals, if the BS receives traffic addressed to a sleeping MS it may buffer the corresponding MAC SDUs and transmit them upon the wake. Alternatively, the BS may choose to discard them. The active state of a power saving class is terminated by the BS by sending a MOB TRF-IND message with positive indication. This decision is made by the BS if there is traffic pending for that MS. In more rare situations a BS may include a positive indication even if there is no DL Traffic to be sent to the MS, given that the MSs periodic ranging is scheduled to start within the next sleep window. A power saving class can also be deactivated by MOB SLP-REQ/BR and UL sleep control header or MOB SLP-RSP/DL sleep control extended subheader messages. The Idle mode is a similar power-saving mechanism. It is intended mostly for situations where an inactive MS traverses a large geographic area populated by multiple BSs. Idle mode is built around the concept of paging group. A paging group is a set of BSs that maintain the same list of MSs in Idle mode and have relative configuration. This removes the need for registration at a specific BS which in turn takes away the need for handover. Upon traffic indication the MS will exit the Idle state but unlike Sleep mode it will then have to perform the network re-entry process. Both these modes aim to minimize power consumption and relieve the network from the redundant traffic of an inactive MS. Figure 5 illustrate the sleep mode procedure. Note that the implementation of both Sleep mode and Idle mode is optional for the MS but mandatory for the BS. B. Power Saving Attacks 1) Signaling DoS Attack: Taking advantage of the power saving features the authors in [27] described an attack for the UMTS networks but indicated that it should be possible to be applied in the WiMAX realm too. According to their study in this attack an attacker could easily cause problems in a network by introducing minimal traffic to it. More specifically, the attacker would fabricate simple TCP/IP packets, for example with empty payload (40 bytes in size), and send them to several sleeping (or idle) john43@example.com. In this way the attack traffic generated is as small as 64 bps and by using a cable modem with 1.5 Mbps uplink bandwidth she can affect simultaneously 24 K MSs approximately. As data becomes available for a specific MS the BS shall have to wake it up which in turn will fall back into sleep state right after the inactivity timeout (the authors assume that this value is 5 sec for many manufacturers). By retransmitting this packet in intervals slightly larger than the inactivity timeout of the MSs the attacker will trap the network into a repeating process of "waking up-putting to sleep" many devices which can prove a great signalling burden. B. Power Saving Attacks Indeed the described methodology is simple enough and the cost for unleashing such attack is extremely low. However, there are several issues associated with the described methodology. First of all, the Sleep mode as well as Idle mode is optional for an MS. Moreover, it is expected that the inactivity timeout counter varies significantly among device manufactures as the default value for this parameter is not defined in the specification. The attacker will be restricted in transmitting intervals equal to the maximum of inactivity timeout value. Also, the attacker must have the means of knowing the IPs of the target MSs. Moreover, she must have means of knowing which MSs are in Sleep/Idle mode. If she chooses devices randomly then only a part of them will be in Sleep/Idle mode and be able to harm them. Also, according to the specification MSs waking up from Sleep mode typically do not conduct initial ranging as the authors claim [28] . As a matter of fact the MS performs the procedure for periodic ranging on regular basis even during Sleep mode. Another point of concern is that, the specification indicates that when there is traffic available for a specific MS the BS can choose between sending a MOB TRF-IND immediately or buffer the data and notify the MS at a later time. This means that when the network is under heavy load the BS may choose to postpone waking up some of the devices. For the reasons mentioned above this attack should by considered unattainable for the WiMAX realm. 2) MOB TRF-IND Water Torture Attack: This attack takes advantage of the unauthenticated MOB TRF-IND normally sent from a BS to a sleeping MS when there is traffic pending for that MS. Skipping sleep mode is expected to reduce the battery life of the MS. This means that, activating and deactivating device components when falling to sleep and waking up from it has an energy cost of its own. If the attacker is able to forge a valid MOB TRF-IND, and repeatedly transmit it to a sleeping MS in the vicinity she would be able to drain the energy resources of the victim on a higher pace. This attack was first described in [15] and is also mentioned in [25] , [29]
{'paper_id': '8344629', 'title': 'Attacks and Countermeasures on 802.16: Analysis and Assessment', 's2_url': 'https://api.semanticscholar.org/CorpusID:8344629', 'source': 'S2ORC'}