Authorization, And Accounting Protocols Research Articles

NFC를 활용한 능동형 인증 방법

최근 NFC(Near Field Communcation) 기반 통신 기능을 채용한 스마트기기 및 OS 등이 확산됨에 따라 기존 RFID를 이용하던 다양한 응용 분야에 대하여 NFC로의 대체가 진행되고 있다. 대표적으로 출입 통제나, e-ticket, 전자 결제 등의 분야에서 NFC가 RFID를 대체하고 있다. 기존의 RFID는 수동적 통신 기능만 제공하여 충분히 안전한 인증 및 권한 검증 방법을 제시하지 못하였으나, 능동형 통신기능을 제공하는 NFC를 활용하면 보다 안전한 인증 방식을 제공하여 다양한 응용에서 요구하는 보안 요구사항을 만족시킬 수 있다. 그러므로 본 논문은 NFC의 능동형 통신 기능을 활용하여 신용카드 결제, 출입통제 시스템 등에 활용될 수 있는 능동형 인증 방식을 제공할 수 있는 방법으로 EAP(Extensible Authentication Protocol)과 AAA(Authentication. Authorization and Accounting) 규약을 활용하는 방법을 제안한다. Since most of recently launched smart devices support NFC(Near Field Communication), RFID applications are tend to be replaced. For instance, previous RFID application areas such as entrance control, mobile e-ticket, electronic payment and et. al are subject to change using NFC. Due to the limitation of passive communication in RFID, it is impossible to cover all security requirements of authentication and authorization mechanism that wide areas of applications demand. Therefore authentication and authorization mechanism based on NFC is very attractive to such applications because active communication methods make it possible to be highly secure in authentication and authorization. In this paper, authors propose a new approach of secure authentication and authorization mechanism using NFC smart devices based on EAP(Extensible Authentication Protocol) and AAA(Authentication, Authorization and Accounting) protocols.

Optimal Accounting Policies for AAA Systems in Mobile Telecommunications Networks

Authentication, Authorization, and Accounting (AAA) deployments are expected to grow significantly in emerging mobile systems as they offer a plethora of services and mobile applications. In current systems, network access servers (NAS) periodically report the service usage of mobile users located within their coverage areas. The periodic reports are used by the billing systems to minimize the incurred capital losses if the serving NAS fails. While shorter reporting intervals are desired for lower losses, they can potentially result in undesirably high signaling load. Because it is prohibitively difficult to obtain optimal reporting intervals in mobile systems due to multitudes of services with different mobility profiles, current accounting standards offer no quantitative measures for selecting a proper reporting interval and AAA systems are typically designed via over provisioning. To address this issue, we propose an adaptive optimization mechanism in multiservice AAA systems which limits the potential loss without excessively generating unnecessary usage reports. Our optimization mechanism embraces the current AAA IETF standards RADIUS and its successor Diameter and does not require any modifications to the AAA protocols nor to the network access servers' implementation, and its implementation scope is limited to the AAA systems. The results demonstrate that our mechanism is robust under various operational conditions, easy to implement, and offers considerable potential for loss control compared to the current static approaches.

AAA MIP 환경에서 공유영역 기반 세션키 재사용을 통한 고속 핸드오프 방식 연구

현재 무선 네트워크 IP를 위한 이동성 자원의 표준인 Mobile IP는 이동 노드(Mobile Node, MN)의 접속에 관한 사용자 인증이 비효율적이다. 본 논문에서는 네트워크 구성원들의 상호 인증 및 보안 서비스를 위해서 인증(Authentication), 권한부여(Authorization) 및 과금(Accounting)을 지원하는 AAA 프로토콜에 기반하여 Mobile IP의 보안성을 유지하고 빠른 핸드오프를 수행하는 새로운 보안 핸드오프 방식을 제안한다. AAA 프로토콜은 QoS를 제한하는 비효율적인 인증 절차가 존재하여 MN이 핸드오프를 수행할 때마다 새로운 세션 키를 분배 받아야 한다. 본 논문에서는 MN이 핸드오프를 수행할 때 발생하는 지연 시간과 MN의 인증으로 인한 AAA 서버의 오버헤드를 줄이고자 공유(Overlap, 오버랩) 네트워크 구조 기반의 세션키 재사용 방법을 제안한다 본 방식에서는 MN의 보안성 향상을 위하여 공유 세션 키를 유선상에서 전달하는 방식에 기반하고, 그에 따라 신속하고 자연스러운 핸드오프 메커니즘을 제공한다. 분석적 모델링결과에 의하면 제안하는 방식은 기존 세션키 재사용 방식과 비교하여 핸드오프 시간을 고려하는 핸드오프 실패율에 있어서 <TEX>$40\%$</TEX>정도의 성능향상을 보인다. The Mobile W provides an efficient and scalable mechanism for host mobility within the Internet. However, the mobility implies higher security risks than static operations in fixed networks. In this paper, the Mobile IP has been adapted to allow AAA protocol that supports authentication, authorization, and accounting(AAA) for security and collection for accounting information of network usage by mobile nodes(MNs). For this goal, we Propose the boundary tone overlapped network structure while solidifying the security for the authentication of an MN. That is, the Proposed scheme delivers the session keys at the wired link for MN's security instead of the wireless one, so that it provides a fast and seamless handoff mechanism. According to the analysis of modeling result, the proposed mechanism compared to the existing session key reuse method is up to about <TEX>$40\%$</TEX> better in terms of normalized surcharge for the handoff failure rate that considers handoff total time.

A scheme for authentication and dynamic key exchange in wireless networks

Despite significant shortcomings in the initial security architecture, 802.11 wireless LANs have experienced explosive growth in recent years. Ongoing work in IEEE standards bodies is currently attempting to fix these shortcomings. One specific topic that has received extensive attention is how to enable these networks to authenticate users and to dynamically establish per-user per-session cryptographic keys. The IEEE 802.1x Port-Based Access Control standard, which formalizes a new EAP-over-LAN (EAPOL) protocol, has emerged as the preferred way to achieve this. The EAPOL protocol employs the extensible authentication protocol (EAP), standardized by the Internet Engineering Task Force, to allow the use of existing and new authentication methods and authentication, authorization, and accounting (AAA) infrastructure. In this paper we present a new EAP scheme — called shared key exchange (SKE) — suitable for use in 802.11 private or public access wireless LANs. The scheme relies on secure pre-shared secret keys in wireless LAN mobile nodes devices and AAA servers. When instantiated with relatively minor changes to RADIUS and EAP, the resulting protocol is provably secure and offers a full set of security features. A second, simplified protocol results from minimal modifications to existing RADIUS and EAP standards, but it provides a lower level of security. Both protocols efficiently support roaming scenarios wherein an end user roams across different networks and requires frequent re-authentication with low latency. The protocols can easily be extended to support migration to new AAA protocols such as DIAMETER.