15.5. Framework for Wireless Network Survivability and Security

In light of the limitations indicated by the current literature, we have developed a framework for the comprehensive treatment of the problems of IA in hybrid wireless access networks. To facilitate the work, a hybrid wireless access network survivability/security framework [5] is developed similar to the approaches of Zolfaghari and Kaudel [33] for wired backbone networks. The wireless access network is viewed as having radio, sensor, access, and intelligent layers, as shown in Figure 15.1, with survivability/security strategies possible at each layer as detailed in Shin et al. [26], Krishnamurthy et al. [5], and Tipper et al. [4]. The components and functions supported at each layer are listed in Table 15.1. The radio network subsystem (RNS) includes the APs, BSs, BSC/RNC, and radio resource management schemes. The sensor subsystem (SenS) consists of a sensor network of sensor nodes with a base station connected to the Internet. The access network subsystem (ANS) supports packet switching, connection management, call management, and mobility management functions using the wired interconnection of APs, BSs, BSC, and MSC. The MSC, HLR, and VLR at the transport layer use the signaling network and services provided by service data management functions, implemented at the intelligent layer, to support connection and mobility management. The intelligent network subsystem (INS) supports security, location, service data and mobility management functions.

Given the framework above to conduct a survivability analysis, performance-oriented survivability metrics along with techniques for evaluating the metrics over various modes of operation are identified. The modes of operation include normal, single-failure, and multiple-failure/attack/disaster modes. Table 15.2 lists examples of possible survivability metrics and failure conditions at each layer in the framework, as well as some of the potential impacts of a failure in terms of the area affected and network service disruption. The survivability of a particular network is based on the ability of the network to meet performance goals stated in terms of service thresholds for each survivability metric, over each operational mode. For example, a performance goal with respect to packet delivery may be 1% packet loss for all cells during normal operation and 2% steady-state packet loss for cells adjacent to or near a failed cell with a maximum transient peak of 10% packet loss. While many of the survivability metrics listed in Table 15.2 have target mean and 0.95 percentile values recommended by ITU [34] for voice, no corresponding values exist for data.

For a network to be fault tolerant, alternate routes must exist between the network components or spare components must be provisioned (e.g., spare link between the BS-BSC with automatic protection switching at the end points). At the ANS and INS levels, traditional survivability strategies such as a mesh-type architecture (at least two connected) are feasible. For example, all of the base stations in a cluster together with their associated BSC could be connected with a self-healing ring.

Table 15.3 lists examples of the types of survivable network design strategies that can be implemented. In addition, specific network controls (e.g., routing) are required to support the restoration of service to connections disrupted by a failure/attack, while maintaining network performance goals. This should enable a network to provide service continuity if possible, while minimizing network congestion. Table 15.3 also lists examples of the type of restoration technique for a given redundancy approach at a particular layer. As an example, a self-healing ring (SHR) at the ANS layer is shown in Figure 15.2. The SHR can provide full restoration capability against a single cable cut and equipment failure. Each node in the SHR uses one add/drop multiplexer (ADM) to access either the primary (outer) ring or the secondary (inner) ring. In normal operation, the system uses the primary ring for both transmitting and receiving data, and the secondary ring is served as a protection system. In the ANS, the SHR could be used to connect a BS and a BSC, BSC and an MSC, or multiple MSCs as a ring topology. Figure 15.2 illustrates an example of employing SHR between an MSC and multiple BSCs in a mobile cellular network. The SHR is simple, fast, and provides full-capacity restoration. However, it can protect a system from failures that occur only in its physical rings and ADMs. Also, it is expensive to implement.

Thus far we have considered failure conditions, in Table 15.4 we look at the layers of Table 15.1 from a security standpoint. At each layer, the messages and protocols are identified that have security implications and the types of security attacks that are possible at each layer. Currently in WLANs, the only repository of the shared key is the AP (or Authentication Server) and the MS. In cellular networks, different entities have possession of different secrets. The subscriber identity is kept in the HLR, MS, and SGSN. For random nonces used in session key generation, the challenge messages are known to the HLR, SGSN, BSC, MS, and BS. Only the MS and AuC know the master key. The AuC maintains a different master key for each MS that belongs to its network. This master key is utilized for securely generating session keys for encrypting voice calls. Table 15.5 shows examples of security breaches at each level and the impact on a network. In a hybrid wireless access network, several security features will have to be in place to prevent or quickly detect security attacks such as those listed in Table 15.5. Table 15.6 provides some typical security features and mechanisms (and network entities that need to share secret information) that can prevent or detect the attacks in Table 15.5.