Advanced Technique for Monitoring and Shielding In Wi-Fi Technology

Advanced Technique for Monitoring and Shielding In Wi-Fi Technology Shyam Nandan Kumar M.Tech, Computer Science and Engineering, LNCT, Indore, MP, India, shyamnandan.mec@gmail.com Abstract Wi-Fi technology is vulnerable to many attacks due to the lack of security, limitation of capability, power limitations, resource handling etc. Security is more and more important, and wireless monitoring and shielding are of prime importance for network security. In order to satisfy secure communication between all nodes, this paper proposes Advanced Technique for Monitoring and Shielding in Wi-Fi Technology. The proposed mechanism explores various security issues of IEEE 802.11 based wireless network and analyzes numerous problems in implementing the wireless monitoring and shielding system. To protect from attack, the system analyzes wireless network protocols efficiently and flexibly, reveals rich information of the IEEE 802.11 protocol such as traffic distribution and different IP connections, and graphically displays later. The Proposed mechanism implements an actual wireless LAN monitoring and shielding system on Maemo operating system to monitor wireless network data stream efficiently and solve the security problems of mobile users. Keywords: IEEE 802.11, IP, Traffic Distribution in Wireless LAN, Maemo OS, WPE, WPS. --------------------------------------------------------------------***---------------------------------------------------------------------- 1. INTRODUCTION solve such issues the paper proposed advance mechanism for network monitoring and shielding in Wi-Fi technology. Wi-Fi is the name of a popular wireless networking technology that uses radio waves to provide wireless highspeed Internet and network connections. Wi-Fiallows an electronic device to exchange data or connect to the internet wirelessly using 2.4 GHz UHF and 5 GHz SHF radio waves. The Wi-Fi Alliance defines Wi-Fi as any "wireless local area network (WLAN) products that are based on the Institute of Electrical and Electronics Engineers' (IEEE) 802.11 standards"[1]. In this paper sections are organized as follows: Section II reviews some related works. Section III describes proposed protocol. In section IV analysis of proposed technique is presented. Section V concludes the paper and presents avenues for future work. 2. RELATED WORK Wireless monitoring is of prime importance for WLAN security. To capture the detailed information, wireless monitoring technique can be used. Wireless monitoring exposes the characteristics on the wireless network itself so that we caninfer more information. Such wireless monitoring allows us to know physical layer header information including signal strength, noise level, and data rate for individual packets. The design of infrastructure-based wireless networks is simple because most of the network functionality lies within the access point. This structure is reminiscent of switched Ethernet or other star-based networks, where a central element controls network flow. Ad-hoc wireless networks, however, do not need any infrastructure to work. Each node can communicate directly with other nodes, so no access point controlling medium access is necessary [2]. Many security issues in the IEEE 802.11 WLAN have been identified and demonstrated in many studies. Due to limited of resources, researchers face challenge to create or define a suitable technique for proper monitoring the various issue associated with Wi-Fi security. Many researchers proposed ideas and protocol solutions for this useful network that is characterized by its limited resources. Previously proposed methods focused on protocol analysis, security monitoring, and shielding the system. While a very few attempts focused on achieving these majors concepts together fairly. The study of Boland and Mousavi [3] in Proceedings of the Canadian Conference on Electrical and Computer Engineering was one of the earlier. They proposed several security issues in WLAN. WLAN security system consists of three different components: authentication, encryption, and WLAN. The primary weakness, shared by all wireless networking devices, is the inability to secure the wireless networks poses several important security challenges like limitations of power, computation capability and storage resources. To A novel 4G multiplatform real-time monitoring system [4] is presented giving emphasis to WLAN part. The main idea of this system is to collect reports from numerous network elements in such way that the system is compatible and operational in any kind of network of any manufacturer and Volume: 02 Issue: 03 May-2014, Available @ http://www.ijretm.com Paper id - IJRETM-2014-02-03-414 1

Operator. Yan, Shi and Zhing [5] proposed wireless monitoring technique and its applications in MAC traffic characterization and network diagnosis. They first identified the pitfalls of wireless monitoring and provided two feasible solutions, namely, merging multiple sniffers and their placement. The security standard, Wi-Fi Protected Setup (WPS), allows embedded devices with limited graphical user interface to connect to the Internet with ease. Wi-Fi Protected Setup has two configurations: The Push Button configuration and the PIN configuration. These embedded devices are also called The Internet of Things and are low-power, battery-operated embedded systems. A number of Wi-Fi manufacturers design chips and modules for embedded Wi-Fi, such as Gain Span [6]. Wired Equivalent Privacy (WEP) encryption was designed to protect against casual snooping but it is no longer considered secure. Tools such as AirSnort or Aircrack-ng can quickly recover WEP encryption keys [7]. Because of WEP's weakness the Wi-Fi Alliance approved Wi-Fi Protected Access (WPA) which uses TKIP. WPA was specifically designed to work with older equipment usually through a firmware upgrade. Though more secure than WEP, WPA has known vulnerabilities. external access. Enabling wireless connectivity reduces security if the network uses inadequate or no encryption. In order to choose secure communication for Wi-Fi network, in the paper, inspired by above related work, we propose a novel approach to monitor and shield the network in Wireless LAN. 3. THE PROPOSED SCHEME To understand network performance and behavioral characteristics in Wi-Fi, we perform monitoring of Network. Based on traffic probe we ve two wireless monitoring approaches: active monitoring and passive monitoring. In this paper we have proposed, advanced technique for monitoring and shielding the Wi-Fi network. Consider the Wi-Fi monitoring environment, which is shown in Fig. 1. A wireless access point (WAP) connects a group of wireless devices to an adjacent wired LAN. An access point resembles a network hub, relaying data between connected wireless devices in addition to a (usually) single connected wired device, most often an Ethernet hub or switch, allowing wireless devices to communicate with other wired devices. The more secure WPA2 using Advanced Encryption Standard was introduced in 2004 and is supported by most new Wi-Fi devices. WPA2 is fully compatible with WPA [8]. Increasingly in the last few years (particularly as of 2007), embedded Wi-Fi modules have become available that incorporate a real-time operating system and provide a simple means of wirelessly enabling any device which has and communicates via a serial port [9]. This allows the design of simple monitoring devices. An example is a portable ECG device monitoring a patient at home. This Wi-Fi-enabled device can communicate via the Internet [10]. A flaw in a feature added to Wi-Fi in 2007, called Wi-Fi Protected Setup, allows WPA and WPA2 security to be bypassed and effectively broken in many situations. The only remedy as of late 2011 is to turn off Wi-Fi Protected Setup [11], which is not always possible. The main issue with wireless network security is its simplified access to the network compared to traditional wired networks such as Ethernet, with wired networking one must either gain access to a building (physically connecting into the internal network) or break through an external firewall. To enable Wi-Fi, one merely needs to be within the wireless range of the Wi-Fi network. Most business networks protect sensitive data and systems by attempting to disallow Fig. 1: Wi-Fi Monitoring Environment The proposed technique for wireless monitoring and shielding has five divisions: User, User Interface, Data Buffer, Protocol Analysis, and Network, Which are shown in Fig. 2. This mechanism works as follows: a) First, the User Interface Module emits a signal to Data Buffer Module every second when no operation happened. Then the Data Buffer Module updates the signal and emits the updated signal to the User Interface Module. Finally, the User Interface Module transforms Volume: 02 Issue: 03 May-2014, Available @ http://www.ijretm.com Paper id - IJRETM-2014-02-03-414 2

the data into graphical data and shows them to users (steps 1 3). b) In case that the user does not have some operation, whenever it captures a new data packet from network card, the following two tasks will be done. First, the Network Module will send the data packet to the Protocol Analysis Module. Then, the Protocol Analysis Module processes the data and stores the data structure into Data Buffer Module (steps 4 6). c) When the user executes an operation or sends a request, the User Interface Module will send a message to the Data Buffer Module to obtain the information; after receiving the message, the Data Buffer Module will start to collect on-demand information and return these information to the User Interface Module; the User Interface Module will transfer the data into graphical data and display them to the user (steps 7 10). d) The User Interface Module sends a command signal to Protocol Analysis Module; the Protocol Analysis Module will change analyzing methods based on the received information and process network data packet in different way. At the same time, the Protocol Analysis Module will send a signal to the Data Buffer Module and require it to change its storage format according to the user request. At last, the User Interface Module will update the information which is displayed and provide user with the needed information (steps 11 15). On the basis of above technique, we implemented a network monitoring and shielding system, which is running on Maemo Operating System, a software platform developed by Nokia and then handed over to Hild on Foundation for smartphones and Internet tablets [12] and is named Maemo Shield. 3.1 Protected Maemo Architecture Maemo Shield is a light weight network monitoring and shielding system which is run on the mobile and portable devices. To some extent, it can solve the security problems for mobile users. Fig. 3 shows the system architecture. Maemo Shield uses multithread technology to implement network date capture and protocol analysis. System Admin User Interface Analyze and Calculate Storage device Protocol Analysis Phase Network Info Network Info Internet Fig - 3: System Architecture Initailly it collect network info for monitoring after that the system starts to performthe Protocol Analysis Module, which is the most critical anddifficult module. At this stage all packets headers will be analyzed and its outcome data will be stored in storage device. Analyze andcalculate phase is responsible for secondary analysis and processing. Now the System Admin coordinates the operating parameters of various analysesand save some configuration. User Interface is the operational interface between system and users. After processing data in detail, the results will be showed to users in the way of diversified image which includes information in text form, in list form, in histogram form, in pie chart form, in grid form, and so on. Fig - 2: Monitoring & Shielding in Wi-Fi Technique Process 3.2 System Module Volume: 02 Issue: 03 May-2014, Available @ http://www.ijretm.com Paper id - IJRETM-2014-02-03-414 3

Working of system follows both the network data capturing and the displaying of the high-level Hildon framework, so development process of the system has two parts as shown in Fig. 4, which demonstrates the system modules. Wireless protocol information is very important for security monitoring so wireless LAN source data, parse management frame; data frame and control frame are also analyzed. Protocol Analysis Module uses MAC frame format. It respectively parses bits of every field in MAC frame corresponded to every field, respectively, to comprehend the structure of each frame. 4. ANALYSIS OF PROPOSED TECHNIQUE To analyze the wireless monitoring technique, we examine the experimental results in the term of its effectiveness in capturing Wi-Fi packets and to present precise statistics information. Device having Maemo operating system with kernel version 4.1 is used to capture 802.11 frame information including the IEEE 802.11 header as well as physical layer header and information of higher layer protocols. Fig - 4: System Modules Raw Data Modules analyzes and control the underlying network data. The system is running on the Nokia s N770/N800/N810 Internet Tablets series. Hildon Interface Modules provides users efficient and dynamic graphics on the Nokia s Maemo development platform. This part takes full advantage of the unique realistic characteristics of Maemo. And all special good features which are not compatible with Linux will be achieved in this part. 4.1 Internet Protocol Oriented Analysis of Network IP oriented analysis is done by system to display the information in the form of a histogram. Fig. 6 shows the variation of IPs. In four cases IP has stable traffic. IPs within 192.168.40.148-239.255.255.250 has its pick value of traffic, while other connection data traffic is relatively small. 3.3Protocol Analysis Wireless monitoring technique involves analysis of wireless protocol. Data link layer begins protocol analysis and decompose the packets via the network layer to the transport layer, and ends with the final analysis of application layer as shown in Fig. 5. Fig - 5: Protocol Analysis Fig - 6: Internet Protocol Oriented Analysis of Network 4.2 Capture and Analyze Packet Based on Sniffer The system intercepts every packet through Network Interface Card and analyzes bit stream of the data packet. After that, the packet information of data-link layer, network layer, and transport layer are shown in a recognizable manner Volume: 02 Issue: 03 May-2014, Available @ http://www.ijretm.com Paper id - IJRETM-2014-02-03-414 4

to the screen in real time. Fig. 7 indicates that the packet is the 135th packet and its lengthis 240 bytes. - - - - Ether header - - - - - - Dest Ether = ff:ff:ff:ff:ff:ff Source Ether = 00:15:af:90:70:b6 Type = 0800 It means that Ethernet protocol is used in link layer,sourcemac address is 00:15:af: 90 : 70:b6, and destinationmacaddress is ff:ff:ff:ff:ff:ff. The protocol identification of upperlayer is 0800. Total Length = 00ce (206 bytes) Checksum = c799 It means UDP protocol is used in transport layer whose source port is 138, and destination port is 138. After removing linker layer and network layer header, the length of packet is 206bytes, and packet checksum is c799. 4.3 Connections vs. Device The system expressed IP connections associated with the device IP connection in the form of mesh. Fig. 8 shows 10 IP connections connected to the device in the left panel, and there is a thick orange line in 10 connections, which indicates that the traffic of the current connection is the largest one. The right panel shows these connections clearly and the data transfer volume. Fig - 7: Capture and Analyze Packet. - - - - - IP header - - - - - - Source IP = 192.168.61.136 Destination IP = 192.168.61.255 Version IHL = 45 Total Length = 00e2 (226 bytes) Identification = 879a Time to Live = 80 Protocol = 11 Header Checksum = b698 It means the network layer using IP protocol whose source address is 192.168.61.136, and destination address is192.168.61.255. After removing link layer header, the length of packet is 226 bytes. Network identification number is 879, and the protocol identification of upper layer is 11. Survival time is 80; header checksum is b798. Fig - 8: Connections vs. Device 4.4 Protocols Analysis The system shows the result of 20data records which use ARP, IP, TCP, UDP, and ICMP protocols and displays the protocol header information in list form, as shown in Fig. 9. Maemo Shield has a buffer buffering the data packet protocol header information of five different protocols, so we can select the switches lower side of the table function panel to view different protocol header information. - - - - - UDP header - - - - - Source Port = 008a (138) Destination Port = 008a (138) Volume: 02 Issue: 03 May-2014, Available @ http://www.ijretm.com Paper id - IJRETM-2014-02-03-414 5

analyze some wireless network information such as the network running status and operating efficiency. The system running results demonstrate the effectiveness of the mechanism in capturing the packets, presenting statistics, and analyzing protocols. The proposed technique has been implemented on the mobile devices, which analyze the wireless protocols efficiently and system has the capability to work stably and accurately. In this paper we have researched various issues about wireless security and analyzed numerous problems in implementing the Wi-Fi. Comparing the proposed technique with others through analysis, the results show that the proposed scheme is more efficient for monitoring and shielding the network in Wi-Fi Technology. Fig - 9: Protocols Analysis 4.5 Distribution of Data Based on Protocol Fig. 10 shows the relative distribution of the data stream protocol: ether share 37.62%, ARP representing 6.29%, IP accounting for 28.05%, UDP accounting for 18.46%, and TCP accounted for 9.58%. Data stream is divided under the protocols and displayed inpie graph. ARP and IP protocol used by the data link layer protocols is ether, so their traffic is less than Ether protocol traffic certainly In the future, we can work on Traffic characteristics and connection status of Wi-Fi. 6. REFERENCES [1]. what is Wi-Fi? A Word Definition from the Webopedia Computer Dictionary. [2]. Jochen Schiller: Mobile Communication, 2 nd Edition, pp. (224-230). [3]. H. Boland and H.Mousavi, Security issues of the IEEE 802.11Bwireless LAN, in Proceedings of the Canadian Conference on Electrical and Computer Engineering, vol. 1, pp. 0333 0336,May2004. Fig - 10: Distribution of Data Based on Protocol 5. CONCLUSION AND FUTURE WORK Wi-Fi has wide popularity. It is big challenge to find out practical secure schemes for communication. It is not easy to [4]. D. Nikitopoulos, A. Trakos, I. Popescu, and K. Xenou, Realtime WLAN monitoring in a 4G multiplatform environment, in Proceedings of the IEEE 17th International Symposium on Personal, Indoor and Mobile Radio Communications (PIMRC 06), pp. 1 5, September 2006. [5]. H. Yan, H. Shi, H. Zhang, and F. Yang, Quantized H control for networked systems with communication constraints, Asian Journal of Control, vol. 15, no. 5, pp. 1468 1476, 2013. [6]. GainSpan specifically designs for Wi-Fi technology between Wi-Fi devices. Extremely useful. "GainSpan lowpower, embedded Wi-Fi". www.gainspan.com. Retrieved 2010. [7]. "Wireless Vulnerabilities & Exploits". wirelessve.org. Retrieved 2008-04-15. [8]. "WPA2 Security Now Mandatory for Wi-Fi CERTIFIED Products" "WPA2 Security Now Mandatory for Wi-Fi CERTIFIED Products". Wi-Fi Alliance. Volume: 02 Issue: 03 May-2014, Available @ http://www.ijretm.com Paper id - IJRETM-2014-02-03-414 6

[9]. "Quatech Rolls Out Airborne Embedded 802.11 Radio for M2M Market". Retrieved 2008-04-29. [10]. "CIE article on embedded Wi-Fi for M2M applications". Retrieved 2008-08-27.[dead link]. [11]. http://www.kb.cert.org/vuls/id/723755 US CERT Vulnerability Note VU#723755. [12]. S. Ansari, S. G. Rajeev, and H. S. Chandrashekar, Packetsniffing: a brief introduction, IEEE Potentials, vol. 21, no. 5, pp.17 19, 2002. Volume: 02 Issue: 03 May-2014, Available @ http://www.ijretm.com Paper id - IJRETM-2014-02-03-414 7