Wireless systems are getting deployed in many new environments with different antenna heights, frequency bands and multipath conditions. This has led to an increasing demand for more channel measurements to understand wireless propagation in specific environments and assist deployment engineering. We design and implement a rapid wireless channel sounding system, using the Universal Software Radio Peripheral (USRP) and GNU Radio software, to address these demands. Our design measures channel propagation characteristics simultaneously from multiple transmitter locations. The system consists of multiple battery-powered transmitters and receivers. Therefore, we can set-up the channel sounder rapidly at a field location and measure expeditiously by analyzing different transmitters' signals during a single walk or drive through the environment. Our design can be used for both indoor and outdoor channel measurements in the frequency range of 1 MHz to 6 GHz. We expect that the proposed approach, with a few further refinements, can transform the task of propagation measurement as a routine part of day-to-day wireless network engineering.

Next-generation wireless LAN security techniques will be based on 802.1x and 802.11i/WPA standards, which mandate mutual authentication and air traffic encryption using per-user per-session keys. These requirements seem to be incompatible with supporting walk-up users (first-time users or one-time users), an important business strategy for public wireless LAN operators. This is because mutual authentication often requires a user to share a secret with an authentication server, but a walk-up user does not have a shared secret established in the public wireless LAN operator's authentication database yet. This paper proposes a secure public wireless LAN access technique to solve the above problem. It supports mutual authentication and air traffic encryption using per-user per-session keys for both registered users and walk-up users. Its authentication process consists of 802.1x/PEAP authentication and browser-based authentication. A registered user passing the 802.1x/PEAP authentication will skip the browser-based authentication. A walk-up user can pass the 802.1x/PEAP authentication using a wild-card username and password, but must then go through the browser-based authentication by either subscribing the public wireless LAN service or paying for it online. As soon as the 802.1x/PEAP authentication is passed, a per-user per-session key is generated and is used to encrypt the user's air traffic based on 802.11i/WPA The system architecture of a public wireless LAN employing this technique is also described.

We propose a new mobile computing paradigm, in which an intelligent card (called an iCard) plugged into a mobile device serves as the centerpiece that provides enhanced networking and application capabilities to the mobile host. Placed between a mobile host and traditional network interfaces, iCard is device independent, easy to program, and offers enhanced security. This paper describes the overall concept of iCard, and the key elements in its hardware and software architecture. The hardware discussions focus on a particular design that we have put together for an actual prototype iCard. We share with readers the rationales behind various choices made in this design. On the software side, we have been developing application programs to be loaded onto the iCard using a StrongARM reference board. To demonstrate the strong potential of the new paradigm represented by iCard, we show how iCard is able to provide mobile IP functions without making any modifications to the host machines.

As wireless LAN is widely deployed, it is desired to support mobile IP for wireless LAN stations such that they can keep sessions alive when a change of wireless LAN environment happens. However, currently it is difficult to add secure mobile IP functions to windows-based wireless LAN stations, because it usually requires modification of windows components, a very troublesome task for independent developers. This paper proposes a special network interface driver programming method, called iDriver technique, to solve this problem. It is a generic method that enables independent developers to implement kernel-level IP-based protocols in network interface drivers to enhance operating systems that do not have these protocols built in their kernels. Using iDriver technique, this paper implements a windows-based secure mobile IPv4 software system without modifying any windows component. It consists of a mobile client driver and a home agent driver. The mobile client driver is responsible for supplying a fixed IP address to windows, monitoring change of wireless LAN environments, applying an IP address from a new wireless LAN, reporting it to the home agent driver, and tunneling encrypted IP packets to/from the home agent driver. The home agent driver is responsible for tracking location of wireless LAN stations, tunneling encrypted IP packets to/from them, and relaying IP packets between them and their correspondent IP nodes. Both drivers can be distributed and installed as stand-alone software products for windows operating systems.

This paper proposes a common password method for users who need to protect multiple accounts using passwords. It requires a user to remember only one password, called a common password, to access any of his/her accounts. Each account is protected by a different password, called a specific password. It is generated by a one-way hash function of an account-specific random number that is stored at the account server or a proxy in an encryption form, where the encryption key is derived from the common password. Compared with a convenient but insecure practice of using one or several passwords to protect multiple accounts, the common password method is convenient and secure. It assures that compromising one specific password does not reveal the common password and any other specific password. A Web-based implementation for the common password method is also presented in this paper. It employs a Web server to store every user's account identifiers and encrypted random numbers, and to supply them to the user in a Web page that contains a password calculator written in JavaScript. The user can compute a specific password using a Web browser on his/her computer for any application that requires password authentication.

We devise an integrated wireless network architecture using proxy servers to support mobility management. The technique takes advantage of the existing functionalities of proxy servers to provide mobility support for applications such as Web browsing and ftp, without modifying the IP protocol stack of the mobile host. The architecture uses proxy servers to force all packets originating from mobile hosts to a close-by mobility-aware router so that the latter can maintain active data connections during handoffs across different networks. By deploying multiple proxy and mobility-aware router pairs and by assigning mobile hosts to proxy servers dynamically, the proposed architecture provides efficient mobility management functionalities, and is inherently scalable.

In the flood of communications now carried via email, it frequently happens that users want to keep some casual or sensitive exchanges off the record, just as in ordinary telephone conversations. Within the system architectures commonly in use today, however, virtually all email transmissions leave a permanent record behind-a paper trail-that is extremely difficult to obliterate. Even after an email is "deleted" by both the sender and the recipient, a copy will likely remain in backup storage at one or more of the email servers that handled the message during its lifetime. Encryption does not solve the problem, because the message can be recovered if the decryption key is revealed, perhaps under court order, or for some other reason. To ensure email privacy, an off-the-record email system is proposed. In this system, the email stays in the sender's computer and is read by the recipient through a Web browser over a secure connection. The message content cannot be recovered from an encrypted copy even with the help of both parties' private keys. Further, the email has a limited lifetime. After it is deleted from the sender's computer, it cannot be recovered from any remaining backup records. The new system is completely compatible with current email implementations. Using existing tools, email users can conduct secure, off-the-record communications. Two practical implementations are given to demonstrate how to deploy off-the-record email both in an intranet as well as on the Internet.

We describe an ongoing broadband fixed two-way wireless field experiment conducted by AT&T Laboratories Research, New Jersey, USA. Our experiment, which is one of the first two-way broadband fixed wireless systems anywhere, offers an end-to-end broadband packet access service, with telecommuting being the primary application for our employee users. It operates in the 2.6 GHz MMDS (Multichannel Multipoint Distribution Service) spectrum, and is based on cable modem technology. The lengthy period of operation has allowed us to make observations about user behavior, weather-related channel impairments, and equipment performance. We have identified several issues in the design of cable modem based systems which need to be tailored to the wireless environment. We have measured a significant path loss effect arising from a combination of rain and foliage. We have developed a Web based network monitoring/management tool that greatly enhances the ability to manage, diagnose, and optimize the system.

We consider use of fixed broadband wireless networks to provide packet services for telecommuting and Internet access. Each cell is divided into multiple sectors, each of them served by a sector antenna colocated with the base station (BS), and user terminals also use directional antennas mounted on the rooftops of homes or small offices and pointed to their respective BS antennas. To support a target data rate of 10 Mb/s, a bandwidth of several MHz is required. Since radio spectrum is expensive, the bandwidth needs to be reused very aggressively. Thus, efficient strategies for frequency reuse and managing cochannel interference are critically important. We propose several algorithms for dynamic radio-resource allocation in the fixed wireless networks. In particular, a method to be referred to as the staggered resource allocation (SRA) method uses a distributed scheduling algorithm to avoid major sources of interference while allowing concurrent packet transmission and meeting signal-to-interference objectives. The performance of the method is studied by analytic approximations and detailed simulation. Our results show that the combination of directional antennas plus the SRA method is highly effective in controlling cochannel interference. For reasonable system parameters, the SRA method delivers a throughput in excess of 30% per sector while permitting a given frequency band to be reused in every sector of every cell. It also provides satisfactory probability of successful packet transmission. In addition, a simple control mechanism can be applied in the method to improve performance for harsh radio environments.