Wireless network access protocols are used in numerous safety critical applications. Network availability is essential for safety critical applications,since loss of availability can cause personal or material damage. An adversary can disrupt the availability of a wireless network using denial of service (DoS) attacks. The most widely used wireless protocols are vulnerable to DoS attacks. Researchers have published DoS attacks against IEEE 802.11 local area networks (LANs), IEEE 802.16 wide area networks (WANs) and GSM andUMTS mobile networks. In this work, we analyze DoS vulnerabilities in wireless network protocols and define four categories of attacks:  jamming attacks, flooding attacks, semantic attacks and implementation specific attacks. We identify semantic attacks as the most severe threat to current andfuture wireless protocols, and as the category that has received the least attention by researchers. During the first phase of the research project we discover semantic DoS vulnerabilities in the IEEE 802.11 communication protocols through manual analysis. The 802.11 standard has been subject to manual analysis of DoS vulnerabilities for more than a decade, thus our results indicate that protocol vulnerabilities can elude manual analysis. We conclude that formal methods are required in order to improve protocol robustness against semantic DoS attacks.We propose a formal method that can be used to automatically discover protocol vulnerabilities. The formal method defines a protocol model, adversary model and cost model. The protocol participants and adversary are modeled as finite state transducers, while the cost is modeled as a function of time. Our primary goal is to construct a formal method that is practical, i.e. does not require a vast amount of resources to implement, and useful, i.e. able to discover protocol vulnerabilities. We verify and validate our proposed method by modeling the 802.11w amendment to the 802.11 standard using Promela as the modeling language. We then use the SPIN model checker to verify the model properties and experiments to validate the results. The modeling and experiments result in the discovery and experimental validation of four new deadlock vulnerabilities that had eluded manual analysis. We find one deadlock vulnerability in 802.11i and three deadlock vulnerabilitiesin 802.11w. A deadlock vulnerability is the most severe form of communication protocol DoS vulnerabilities, and their discovery and removal are an essential part of robust protocol design. Thus, we conclude that our proposed formal method is both practical and useful.

Future Wireless Local Area Networks (WLANs) with high carrier frequencies and wide channels need a dense deployment of Access Points (APs) to provide good performance. In densely deployed WLANs associations of stations and handovers need to be managed more intelligently than today. This dissertation studies when and how a station should perform a handover and to which AP from a theoretical and a practical perspective. We formulate and solve optimization problems that allow to compute the optimal AP for each station in normal WLANs and WLANs connected via a wireless mesh backhaul. Moreover, we propose to use software defined networks and the OpenFlow protocol to optimize station associations, handovers and traffic rates. Furthermore, we develop new mechanisms to estimate the quality  of a link  between a station and an AP. Those mechanisms allow optimization algorithms to make better decisions about when to initiate a handover. Since handovers in today’s WLANs are slow and may disturb real-time applications such as video streaming, a faster procedure is developed in this thesis. Evaluation results from wireless testbeds and network simulations show that our architectures and algorithms significantly increase the performance of WLANs, while they are backward compatible at the same time.

Although evolving mobile technologies bring millions of users closer to the vision of information anywhere-anytime, device battery depletions hamper the quality of experience to a great extent. We argue that the design of energy-efficient solutions starts by energy-awareness and propose EnergyBox, a tool that provides accurate and repeatable energy consumption studies for 3G and WiFi transmissions at the user end. We recognize that the energy consumption of data transmission is highly dependable on the traffic pattern, and provide the means for trace-based iterative packet-driven simulation to derive the operation states of wireless interfaces. The strength of EnergyBox is that it allows to modularly set the 3G network parameters specified at operator level, the adaptive power save mode mechanism for a WiFi device, and the different power levels of the operation states for different handheld devices. EnergyBox enables efficient energy consumption studies using real data, which complements the device-dependent laborious physical power measurements. Using real application transmission traces, we have validated EnergyBox showing an accuracy range of 94-99% for 3G and 93-99% for WiFi compared to the real measured energy consumption by a 3G modem and a smartphone with WiFi.

We propose a simple, passive and deployable approach for fingerprinting traffic on the wired side as a solution for three critical stealth attacks in wireless networks. We focus on extracting traces of the 802.11 medium access control (MAC) protocol from the temporal arrival patterns of incoming traffic streams as seen on the wired side, to identify attacker behavior. Attacks addressed include unauthorized access points, selfish behavior at the MAC layer and MAC layer covert timing channels. We employ the Bayesian binning technique as a means of classifying between delay distributions. The scheme requires no change to the 802.11 nodes or protocol, exhibits minimal computational overhead and offers a single point of discovery. We evaluate our model using experiments and simulations.

We present a covert side channel that uses the 802.11 MAC rate switching protocol. The covert channel provides a general method to hide communications in an 802.11 LAN. The technique uses a one-time password algorithm to ensure high-entropy randomness of the covert messages. We investigate how the covert side channel affects node throughput in mobile and non-mobile scenarios. We also investigate the covertness of the covert side channel using standardized entropy. The results show that the performance impact is minimal and increases slightly as the covert channel bandwidth increases. We further show that the channel has 100% accuracy with minimal impact on rate switching entropy. Finally, we present two applications for the covert channel: covert authentication and covert WiFi botnets.

In this thesis, we characterize the proprietary active scanning algorithm of several wireless network interface cards. Our experiments are the first of its kind to observe the complete scanning process as the wireless network interface cards probe all the channels in the 2.4GHz spectrum. We discuss the: 1) correlation of channel popularity during active scanning and access point channel deployment popularity; 2) number of probe request frames statistics on each channel; 3) channel probe order; and 4) dwell time. The knowledge gained from characterizing wireless network interface cards is important for the following reasons: 1) it helps one understand how active scanning is implemented in different hardware and software; 2) it can be useful in identifying a wireless rogue host; 3) it can help implement Active Scanning in network simulators; and 4) it can radically influence research in the familiar fields like link-layer handovers and effective deployment of access points.

Location techniques that satisfy the requirements of advanced Location-Based Services (LBS) in environments where GPS fails are needed, therefore accurate indoor positioning is becoming increasingly important. This PhD Thesis is devoted to the research on location of mobile devices employing WLAN (IEEE 802.11). The use of this kind of wireless networks infrastructures for positioning enables a powerful synergy between communications and location and allows solutions with good performances at moderated costs. However the adopted WLAN location methods suffer from important limitations that prevents from applying them to some fields that need more flexible and robust solutions. The main objective of this PhD is exploring precise WLAN location methods that allow overcoming these limitations. The researched methods here are based on measuring the Time Of Arrival (TOA), which is the time that takes the signal propagating from the transmitter to the receiver. TOA-based location works in two stages: ranging and positioning. The ranging consists of estimating the distances between the targeted terminal and several WLAN access points, each distance obtained measuring the TOA and then multiplying it by the speed of the WLAN signal. After that, the positioning takes as inputs the estimated distances and the known coordinates of the involved access points and calculates the position of the terminal by means of a trilateration or tracking algorithm. The key problem is that the characteristics of the IEEE 802.11 protocols difficult to perform accurate TOA measurements. The main challenge that faces the research work reported here is demonstrating the feasibility of achieving this while keeping the modifications over standard WLAN consumer equipment at minimum. The objective of this work can be understood as exploring the current limits of TOA-based methods over WLAN, making contributions that form a complete TOA-based location method that goes a step forward with respect to the other existing proposals. First, research on TOA-based ranging -the key component of TOA-based location methods- is reported. The general adopted approach consists of performing Round Trip Time (RTT) measurements employing IEEE 802.11 MAC frames, taking the maximum advantage of the combination of IEEE 802.11 protocol and WLAN consumer devices mechanisms. After that, the performed research on trilateration/tracking -the second stage of TOA-based location methods- is explained. Finally some performed studies about the achieved location method are presented. Lloc i data Signatura / Actualment existeix la necessitat de disposar de tècniques de localització que satisfacin els requeriments de serveis avançats basats en localització en entorns on GPS no està disponible, de manera que el posicionament precís en interiors d’edificis és cada vegada més important. Aquesta tesi doctoral està dedicada a la investigació sobre la localització de dispositius mòbils que utilitzen WLAN (IEEE 802.11). L'ús d'aquest tipus de xarxes sense fils per al posicionament permet una profitosa sinèrgia entre les comunicacions i la localització i permet solucions amb un bon rendiment a un cost moderat. No obstant això, els mètodes basats WLAN proposats fins el moment pateixen de limitacions importants que impedeix la seva aplicació a alguns camps que requereixen solucions més flexibles i robustes. L'objectiu principal d'aquesta tesi és explorar mètodes de localització precisa WLAN que permetin superar aquestes limitacions. Els mètodes que s’han investigat durant la tesi es basen en la mesura del time of arrival (TOA), que és el temps que tarda el senyal en propagar-se des del transmissor fins al receptor. En les tècniques de posicionament basades en TOA s’hi poden diferenciar dues fases: ranging i posicionament. El ranging consisteix en l’estimació de distàncies entre el terminal a localitzar i diversos punts d'accés WLAN; cada estimació de distància s’obté mesurant el TOA i multiplicant-lo després per la velocitat de propagació del senyal IEEE 802.11. Un cop fet això, el posicionament pren com a inputs les distàncies estimades per a, conegudes les coordenades dels punts d'accés involucrats, calcular la posició del terminal per mitjà d'un algoritme de tracking o trilateració. El problema clau és que les característiques dels protocols IEEE 802.11 a dia d’avui fan difícil la realització de mesures precises de TOA d’una manera senzilla. El principal repte que afronta el present treball de recerca és demostrar la viabilitat d’això darrer, minimitzant en la major mesura possible les modificacions sobre els equips WLAN comercials. L'objectiu d'aquest treball pot ser entesa com l'exploració dels límits actuals dels mètodes de posicionament basats en TOA sobre WLAN, realitzant contribucions que conformen un mètode complet de localització basat en TOA que pretén anar un pas endavant respecte a les propostes existents. En primer lloc, la investigació sobre ranging basat en TOA -el component clau dels mètode de localització TOA- és explicada en detall. El mètode general adoptat per a calcular el TOA consisteix en la mesura del temps d'anada i tornada del senyal, round trip time (RTT), utilitzant trames MAC IEEE 802.11 per tal de treure el màxim profit de la combinació del protocol IEEE 802.11 i els mecanismes dels dispositius WLAN comercials. Després d'això, es detalla la investigació realitzada sobre trilateració i tracking, la segona etapa dels mètodes de localització basats en TOA. Finalment es descriuen alguns estudis realitzats sobre les prestacions, possibles millores i encaix en futurs estàndars del mètode de localització explorat.

This thesis contributes toward the design of a quality-of-service (QoS) aware network layer for wireless ad hoc networks. With the lack of an infrastructure in ad hoc networks, the role of the network layer is not only to perform multihop routing between a source node and a destination node, but also to establish an end-to-end connection between communicating peers that satisfies the service level requirements of multimedia applications running on those peers. Wireless ad hoc networks represent autonomous distributed systems that are infrastructure-less, fully distributed, and multi-hop in nature. Over the last few years, wireless ad hoc networks have attracted significant attention from researchers. This has been fueled by recent technological advances in the development of multifunction and low-cost wireless communication gadgets. Wireless ad hoc networks have diverse applications spanning several domains, including military, commercial, medical, and home networks. Projections indicate that these self-organizing wireless ad hoc networks will eventually become the dominant form of the architecture of telecommunications networks in the near future. Recently, due to increasing popularity of multimedia applications, QoS support in wireless ad hoc networks has become an important yet challenging objective. The challenge lies in the need to support the heterogeneous QoS requirements (e.g., data rate, packet loss probability, and delay constraints) for multimedia applications and, at the same time, to achieve efficient radio resource utilization, taking into account user mobility and dynamics of multimedia traffic. In terms of research contributions, we first present a position-based QoS routing framework for wireless ad-hoc networks. The scheme provides QoS guarantee in terms of packet loss ratio and average end-to-end delay (or throughput) to ad hoc networks loaded with constant rate traffic. Via cross-layer design, we apply call admission control and temporary bandwidth reservation on discovered routes, taking into consideration the physical layer multi-rate capability and the medium access control (MAC) interactions such as simultaneous transmission and self interference from route members. Next, we address the network-layer resource allocation where a single-hop ad hoc network is loaded with random traffic. As a starting point, we study the behavior of the service process of the widely deployed IEEE 802.11 DCF MAC when the network is under different traffic load conditions. Our study investigates the near-memoryless behavior of the service time for IEEE 802.11 saturated single-hop ad hoc networks. We show that the number of packets successfully transmitted by any node over a time interval follows a general distribution, which is close to a Poisson distribution with an upper bounded distribution distance. We also show that the service time distribution can be approximated by the geometric distribution and illustrate that a simplified queuing system can be used efficiently as a resource allocation tool for single hop IEEE 802.11 ad hoc networks near saturation. After that, we shift our focus to providing probabilistic packet delay guarantee to multimedia users in non-saturated IEEE 802.11 single hop ad hoc networks. We propose a novel stochastic link-layer channel model to characterize the variations of the IEEE 802.11 channel service process. We use the model to calculate the effective capacity of the IEEE 802.11 channel. The channel effective capacity concept is the dual of the effective bandwidth theory. Our approach offers a tool for distributed statistical resource allocation in single hop ad hoc networks, which combines both efficient resource utilization and QoS provisioning to a certain probabilistic limit. Finally, we propose a statistical QoS routing scheme for multihop IEEE 802.11 ad hoc networks. Unlike most of QoS routing schemes in literature, the proposed scheme provides stochastic end-to-end delay guarantee, instead of average delay guarantee, to delay-sensitive bursty traffic sources. Via a cross-layer design approach, the scheme selects the routes based on a geographical on-demand ad hoc routing protocol and checks the availability of network resources by using traffic source and link-layer channel models, incorporating the IEEE 802.11 characteristics and interaction. Our scheme extends the well developed effective bandwidth theory and its dual effective capacity concept to multihop IEEE 802.11 ad hoc networks in order to achieve an efficient utilization of the shared radio channel while satisfying the end-to-end delay bound.

Wireless Mesh Networks (WMNs) built with commodity 802.11 radios are a cost-effective means of providing last mile broadband Internet access. Their multihop architecture allows for rapid deployment and organic growth of these networks. 802.11 radios are an important building block in WMNs. These low cost radios are readily available, and can be used globally in license-exempt frequency bands. However, the 802.11 Distributed Coordination Function (DCF) medium access mechanism does not scale well in large multihop networks. This produces suboptimal behavior in many transport protocols, including TCP, the dominant transport protocol in the Internet. In particular, cross-layer interaction between DCF and TCP results in flow level unfairness, including starvation, with backlogged traffic sources. Solutions found in the literature propose distributed source rate control algorithms to alleviate this problem. However, this requires MAC-layer or transport-layer changes on all mesh routers. This is often infeasible in practical deployments. In wireline networks, router-assisted rate control techniques have been proposed for use alongside end-to-end mechanisms. We evaluate the feasibility of establishing similar centralized control via gateway mesh routers in WMNs. We find that commonly used router-assisted flow control schemes designed for wired networks fail in WMNs. This is because they assume that: (1) links can be scheduled independently, and (2) router queue buildups are sufficient for detecting congestion. These abstractions do not hold in a wireless network, rendering wired scheduling algorithms such as Fair Queueing (and its variants) and Active Queue Management (AQM) techniques ineffective as a gateway-enforceable solution in a WMN. We show that only non-work-conserving rate-based scheduling can effectively enforce rate allocation via a single centralized traffic-aggregation point. In this context we propose, design, and evaluate a framework of centralized, measurement-based, feedback-driven mechanisms that can enforce a rate allocation policy objective for adaptive traffic streams in a WMN. In this dissertation we focus on fair rate allocation requirements. Our approach does not require any changes to individual mesh routers. Further, it uses existing data traffic as capacity probes, thus incurring a zero control traffic overhead. We propose two mechanisms based on this approach: aggregate rate control (ARC) and per-flow rate control (PFRC). ARC limits the aggregate capacity of a network to the sum of fair rates for a given set of flows. We show that the resulting rate allocation achieved by DCF is approximately max-min fair. PFRC allows us to exercise finer-grained control over the rate allocation process. We show how it can be used to achieve weighted flow rate fairness. We evaluate the performance of these mechanisms using simulations as well as implementation on a multihop wireless testbed. Our comparative analysis show that our mechanisms improve fairness indices by a factor of 2 to 3 when compared with networks without any rate limiting, and are approximately equivalent to results achieved with distributed source rate limiting mechanisms that require software modifications on all mesh routers.

In the last decade, 802.11 wireless devices data-rates have increased by three orders of magnitude, while communications experiencing low throughput are still largely present. Such throughput loss is a fundamental problem of wireless networking that is difficult to diagnose and amend. My research addresses two key causes of throughput loss: MAC layer protocol overhead and destructive link interference. First, I design WiFi-Nano reducing the channel access overhead by an order of magnitude leveraging an innovative speculative technique to transmit preambles. This new concept is based on simultaneous preamble transmission and detection via a self-interference cancellation design, and paves the way to the realization of the collision detection paradigm in wireless networks. Next, I propose 802.11ec (Encoded Control), the first 802.11-based protocol that eliminates the overhead of control packets. Instead, 802.11ec coordinates node transmissions via a set of predefined pseudo-noise codewords, resulting in the dramatic increase of throughput and communication robustness. Finally, I design MIDAS, a model-driven network management tool that alleviates low throughput wireless links identifying key corrective actions. MIDAS' key contribution is to reveal the fundamental role of node transmission coordination in characterizing destructive interference. I implement WiFi-Nano, 802.11ec, and MIDAS using a combination of WARP FPGA-based radio boards, custom emulation platforms, and network simulators. The results obtained show that WiFi-Nano increases the network throughput by up to 100%, 802.11ec improves network access fairness by up to 90%, and MIDAS identifies corrective actions with a prediction error as low as 20%.