Attacks on PKM Protocols of IEEE 802.16 and Its Later Versions

Without physical boundaries, a wireless network faces many more vulnerabilities than a wired network does. IEEE 802.16 provides a security sublayer in the MAC layer to address the privacy issues across the fixed BWA (broadband wireless access). Several articles have been published to address the flaws in IEEE 802.16 security after IEEE 802.16-2001 was released. However, even the enhanced version IEEE 802.16-2004 does not settle all the problems and additional flaws emerge. In addition, we found that PKM (privacy and key management) protocols version 2 (PKMv2), proposed by recently released IEEE 802.16e, is also vulnerable to new attacks. In this paper, we first overview the IEEE 802.16 standard, especially the security sublayer, and then investigate possible attacks on the basic PKM protocol in IEEE 802.16 as well as in its other versions from related works and the newest PKMv2. We also give possible solutions to counter those attacks and verify our analysis using formal (BAN) logic.