Authorization And Accounting Research Articles

Loosely Coupled Heterogeneous Networks Convergence using IMS-SIP-AAA

this paper a heterogeneous network model based on the IMS-SIP (session Initiation protocol) with the help of Authentication, Authorization, and Accounting (AAA) protocol that integrates the Worldwide Interoperability for Microwave Access (WiMAX), Universal Mobile Telecommunications System (UMTS) and Wireless Local Area Network (WLAN) technologies is proposed to improve QoS. The proposed Loose coupled WiMAX-UMTS-WLAN convergence architecture using IMS is compared with interworking of WiMAX-UMTS-WLAN without IMS and WiMAX-UMTS interworking with IMS. The QoS performance metrics such as different traffic delays such as Voice over IP (delay sensitive), Video streaming, Web browsing and background traffic (email, FTP), throughput are analyzed and simulated using OPNET 14.5. KeywordsUMTS, WLAN, Interworking, QoS, IMS, SIP,

Design and performance analysis of a dynamic-paging AAA mobility management scheme for PMIPv6-based wireless networks

Proxy mobile IPv6 (PMIPv6) is a network–based mobility management protocol. It does not require the involvement of the mobile node (MN) in mobility management. However, MN between the mobile access gateway (MAG) and the local mobility anchor (LMA) in a message to the signalling delivery process can cause high overhead. Moreover, even LMA between PMIPv6 domains could cause high signalling overhead. In this paper, we propose a dynamic–paging authorisation, authentication and accounting (AAA) mobility management scheme (DP–AAA) to apply dynamic paging to reduce signalling overhead and to support global mobility in PMIPv6 domains. The dynamic paging scheme does not provide binding updates to MNs that are in a dormant state. According to traffic patterns and mobility, the MN's domain can be determined dynamically in the paging area. Performance analyses indicate that the proposed scheme performs better than static paging and PMIPv6.

PANATIKI: A Network Access Control Implementation Based on PANA for IoT Devices

Internet of Things (IoT) networks are the pillar of recent novel scenarios, such as smart cities or e-healthcare applications. Among other challenges, these networks cover the deployment and interaction of small devices with constrained capabilities and Internet protocol (IP)-based networking connectivity. These constrained devices usually require connection to the Internet to exchange information (e.g., management or sensing data) or access network services. However, only authenticated and authorized devices can, in general, establish this connection. The so-called authentication, authorization and accounting (AAA) services are in charge of performing these tasks on the Internet. Thus, it is necessary to deploy protocols that allow constrained devices to verify their credentials against AAA infrastructures. The Protocol for Carrying Authentication for Network Access (PANA) has been standardized by the Internet engineering task force (IETF) to carry the Extensible Authentication Protocol (EAP), which provides flexible authentication upon the presence of AAA. To the best of our knowledge, this paper is the first deep study of the feasibility of EAP/PANA for network access control in constrained devices. We provide light-weight versions and implementations of these protocols to fit them into constrained devices. These versions have been designed to reduce the impact in standard specifications. The goal of this work is two-fold: (1) to demonstrate the feasibility of EAP/PANA in IoT devices; (2) to provide the scientific community with the first light-weight interoperable implementation of EAP/PANA for constrained devices in the Contiki operating system (Contiki OS), called PANATIKI. The paper also shows a testbed, simulations and experimental results obtained from real and simulated constrained devices.

Out-of-band federated authentication for Kerberos based on PANA

Nowadays, network operators and educational and research communities are extending the access to their Internet application services to external end users by deploying, with other domains, the so-called identity federations. In these federations, end users use the identity and authentication credentials registered in their home organizations for accessing resources managed by a remote service provider. However, current identity federation solutions focus mainly on assisting network access and web services, while a significant number of services are left aside (e.g., SSH, FTP, Jabber, etc.). Taking advantage of the widespread adoption of Kerberos by current application services, this paper presents a solution to provide federated access to any kind of application service by using existing Authentication, Authorization and Accounting (AAA) infrastructures. The solution bootstraps a security association, in the service provider which enables the acquisition of a Kerberos credential to access the service. To link the end user authentication with the AAA infrastructure and the bootstrapping of the security association the solution uses the so-called Protocol for Carrying Authentication for Network Access (PANA).

ID-Based User Authentication Scheme for Cloud Computing

In cloud computing environments, user authentication is an important security mechanism because it provides the fundamentals of authentication, authorization, and accounting (AAA). In 2009, Wang et al. proposed an identity-based (ID-based) authentication scheme to deal with the user login problem for cloud computing. However, Wang et al.'s scheme is insecure against message alteration and impersonation attacks. Besides, their scheme has large computation costs for cloud users. Therefore, we propose a novel ID-based user authentication scheme to solve the above mentioned problems. The proposed scheme provides anonymity and security for the user who accesses different cloud servers. Compared with the related schemes, the proposed scheme has less computation cost so it is very efficient for cloud computing in practice.

Using a Trusted WLAN Network to Offload Mobile Traffic and Leverage Deployed Broadband Network Gateways

This paper introduces the concept and architecture for the Alcatel-Lucent solution to wireless local area network (WLAN) offload in a case where the WLAN network can be considered as trusted by the home operator of the user. Leveraging up-to-date WLAN access points (APs) that provide both support for strong user equipment (UE) authentication — Universal Subscriber Identity Module (USIM) based- and ciphering (AES-based), WLAN access can offer “trusted” access to the Evolved Packet Core (EPC). This trusted access to the EPC can provide Internet Protocol (IP) address preservation when the terminal moves between 3rd Generation Partnership Project (3GPP) access and WLAN access without requiring the UE to support IPsec tunnels to the EPC or Dual Stack Mobile IP version 6 (DSMIPv6). A WLAN gateway (WLAN-GW) acting as an edge router for the UE is able to get policies from the home operator's authorization, authentication, and accounting (AAA) server at UE authentication, and based on these policies, to either send the user traffic to the EPC anchor point — the Packet Data Network Gateway (P-GW) — or to offload such traffic, for example, to the Internet. © 2012 Alcatel-Lucent.

프록시 모바일 IPv6 네트워크에서 LMA도메인 간 핸드오버 기법의 보안성 분석 및 구현

In PMIPv6-based network, mobile nodes can be made smaller and lighter because the network nodes perform the mobility management-related functions on behalf of the mobile nodes. The one of the protocols, Fast Handovers for Proxy Mobile IPv6(FPMIPv6)[1] has studied by the Internet Engineering Task Force(IETF). Since FPMIPv6 adopts the entities and the concepts of Fast Handovers for Mobile IPv6(FMIPv6) in Proxy Mobile IPv6(PMIPv6), it reduces the packet loss. Conventional scheme has proposed that it cooperated with an Authentication, Authorization and Accounting(AAA) infrastructure for authentication of a mobile node in PMIPv6, Despite the best efficiency, without begin secured of signaling messages, PMIPv6 is vulnerable to various security threats such as the DoS or redirect attAcks and it can not support global mobility between PMIPv. In this paper, we analyze Kang-Park & ESS-FH scheme, and then propose an Enhanced Security scheme for FPMIPv6(ESS-FP). Based on the CGA method and the pubilc key Cryptography, ESS-FP provides the strong key exchange and the key independence in addition to improving the weaknesses for FPMIPv6. The proposed scheme is formally verified based on Ban-logic, and its handover latency is analyzed and compared with that of Kang-Park scheme[3] & ESS-FH and this paper propose inter-domain fast handover sheme for PMIPv6 using proxy-based FMIPv6(FPMIPv6).

AAA authentication for network mobility

Network mobility (NEMO) is a protocol proposed for the mobility management of a whole network. It offers seamless Internet connectivity to the mobile end users. However, the NEMO protocol has not been widely used in Internet, because it has not considered the secure problem about authentication and authorization. The proposed framework designed an access control scheme especially used for the NEMO network environment. It is based on the authentication, authorization, and accounting (AAA) system. It can make use of the mobile router to authenticate for all the mobile nodes at the same time, and uses the mobile network node (MNN)-list synchronization mechanism to control the secure access of the MNN. By using the foreign AAA server cache mechanism, this scheme can decrease the authentication time delay and improve the efficiency of the network. The advantages are proved by the comparison with other recent related studies via the OPNET simulations.

NFC를 활용한 능동형 인증 방법

최근 NFC(Near Field Communcation) 기반 통신 기능을 채용한 스마트기기 및 OS 등이 확산됨에 따라 기존 RFID를 이용하던 다양한 응용 분야에 대하여 NFC로의 대체가 진행되고 있다. 대표적으로 출입 통제나, e-ticket, 전자 결제 등의 분야에서 NFC가 RFID를 대체하고 있다. 기존의 RFID는 수동적 통신 기능만 제공하여 충분히 안전한 인증 및 권한 검증 방법을 제시하지 못하였으나, 능동형 통신기능을 제공하는 NFC를 활용하면 보다 안전한 인증 방식을 제공하여 다양한 응용에서 요구하는 보안 요구사항을 만족시킬 수 있다. 그러므로 본 논문은 NFC의 능동형 통신 기능을 활용하여 신용카드 결제, 출입통제 시스템 등에 활용될 수 있는 능동형 인증 방식을 제공할 수 있는 방법으로 EAP(Extensible Authentication Protocol)과 AAA(Authentication. Authorization and Accounting) 규약을 활용하는 방법을 제안한다. Since most of recently launched smart devices support NFC(Near Field Communication), RFID applications are tend to be replaced. For instance, previous RFID application areas such as entrance control, mobile e-ticket, electronic payment and et. al are subject to change using NFC. Due to the limitation of passive communication in RFID, it is impossible to cover all security requirements of authentication and authorization mechanism that wide areas of applications demand. Therefore authentication and authorization mechanism based on NFC is very attractive to such applications because active communication methods make it possible to be highly secure in authentication and authorization. In this paper, authors propose a new approach of secure authentication and authorization mechanism using NFC smart devices based on EAP(Extensible Authentication Protocol) and AAA(Authentication, Authorization and Accounting) protocols.

Inter-Domain Path Provisioning with Security Features: Architecture and Signaling Performance

Significant research and standardization efforts are underway to enable automated computation and reservation of connection-oriented paths (circuits) across multiple domains. In the absence of a secure authentication and authorization mechanism, however, carriers continue to provision connections manually, which leads to large setup delays and increases possibility of configuration errors. Carriers also lack mechanisms to meter connection quality during the service lifetime and typically do not exchange accounting information for established connections for auditing and billing purposes. In this paper, we address the challenge for automatic multi-domain path provisioning with authentication, authorization and accounting (AAA) capabilities in carrier-grade transport networks. The designed solution secures computation and reservation for path provisioning and also leverages a standard accounting model which incorporates the accounting signaling for an inter-domain connection. In order to evaluate the impact of the proposed framework on signaling performance, we also provide an analytical framework scalable to large inter-domain network scenarios. We verify the analysis using event-driven simulations and then use this analytical model to quantify the feasibility of our model in terms of signaling load and signaling delay for a wide range of network scenarios.

On Implementing IPTV Platform with IPv4 and IPv6 Devices

The end of IPv4 addresses is now a reality. Providers not updated to IPv6 will have to hurry up the IPv6 start in its own network. Introduction of IPv6 means not only change of main routers but also change of mentality in operators, applications’ programmers besides end users. Even when for the last years the core network is prepared for transferring IPv6 traffic, other built-in parts of the Internet limit the IPv6 start. Examples of these limitations we find in not IPv6-awareness of many applications and services. For instance, voice over IP service, which uses session initiation protocol (SIP) needs to implement IPv6 aware SIP proxies and IPv6 aware AAA (authentication, authorization and accounting) servers as well as adapting application programming interfaces to IPv6. Internet protocol television (IPTV) system includes many different hardware devices, which not always are IPv6 compatible. In this paper, we propose a global solution for integrating all the devices, these one working on IPv4 and these one working on IPv6, under the same IPTV platform. This solution allows end users to receive IPTV stream irrespective of IP protocol used. The proposed solution is particularly relevant for small IPTV systems, which, step by step, are adapting into IPv6.

A lightweight mutual authentication mechanism for network mobility in IEEE 802.16e wireless networks

Many mobile network nodes (MNNs) in public transport move together as a large-scale mobile network. Therefore, RFC 3963 proposes a network layer solution called network mobility (NEMO) as the basic support protocol for network mobility management. NEMO is designed so that network mobility is transparent to nodes in the mobile network, thereby reducing the signaling overhead. However, NEMO does not specify how authentication, authorization and accounting (AAA) should be handled, and it inherits the drawbacks of long handoff latency from Mobile IPv6 (MIPv6). In this paper, we develop a lightweight mutual authentication mechanism (LMAM) with low computational overhead and achieve local authentication based on NEMO and the AAA model over IEEE 802.16e networks. Moreover, LMAM can resist various attacks. In addition, we propose an enhanced hierarchical Mobile IPv6 (E-HMIPv6) scheme to reduce intra-domain handoff latency. We then integrate LMAM into E-HMIPv6 without increasing the signaling overhead. Our analysis results show that the integrated scheme, called LE-HMIPv6 outperforms existing schemes in terms of authentication and handoff latency.

Providing EAP-based Kerberos pre-authentication and advanced authorization for network federations

Kerberos is a well-known standard protocol which is becoming one of the most widely deployed for authentication and key distribution in application services. However, whereas service providers use the protocol to control their own subscribers, they do not widely deploy Kerberos infrastructures to handle subscribers coming from foreign domains, as happens in network federations. Instead, the deployment of Authentication, Authorization and Accounting (AAA) infrastructures has been preferred for that operation. Thus, the lack of a correct integration between these infrastructures and Kerberos limits the service access only to service provider's subscribers. To avoid this limitation, we design an architecture which integrates a Kerberos pre-authentication mechanism, based on the use of the Extensible Authentication Protocol (EAP), and advanced authorization, based on the standards SAML and XACML, to link the end user authentication and authorization performed through an AAA infrastructure with the delivery of Kerberos tickets in the service provider's domain. We detail the interfaces, protocols, operation and extensions required for our solution. Moreover, we discuss important aspects such as the implications on existing standards.

An authentication protocol offering service anonymity of mobile device in ubiquitous environment

With the advent of ubiquitous era, various devices and services using wireless network are increasing. For communications in wireless network, mobile devices are used and various services are increasingly provided through mobile devices. The AAA (Authentication, Authorization, and Accounting) that authorizes and manages the mobile devices is processing the standardization for various application services for the purpose of the standardization of authentication, authorization, and accounting to provide safety and reliability of various services and protocols of both wired and wireless network. However, even if AAA exists the development of network varies vulnerabilities and attack types, and accordingly the exposure of information appears as the biggest problem. Therefore, this study suggests the safe authentication method that protects against information exposure by guaranteeing anonymity of service with temporal ID, and provides efficiency because AAA authentication server is based on the ticket given to a service server without the need of re-authentication when mobile node authorized from the AAA authentication server receives service.

Optimal Accounting Policies for AAA Systems in Mobile Telecommunications Networks

Authentication, Authorization, and Accounting (AAA) deployments are expected to grow significantly in emerging mobile systems as they offer a plethora of services and mobile applications. In current systems, network access servers (NAS) periodically report the service usage of mobile users located within their coverage areas. The periodic reports are used by the billing systems to minimize the incurred capital losses if the serving NAS fails. While shorter reporting intervals are desired for lower losses, they can potentially result in undesirably high signaling load. Because it is prohibitively difficult to obtain optimal reporting intervals in mobile systems due to multitudes of services with different mobility profiles, current accounting standards offer no quantitative measures for selecting a proper reporting interval and AAA systems are typically designed via over provisioning. To address this issue, we propose an adaptive optimization mechanism in multiservice AAA systems which limits the potential loss without excessively generating unnecessary usage reports. Our optimization mechanism embraces the current AAA IETF standards RADIUS and its successor Diameter and does not require any modifications to the AAA protocols nor to the network access servers' implementation, and its implementation scope is limited to the AAA systems. The results demonstrate that our mechanism is robust under various operational conditions, easy to implement, and offers considerable potential for loss control compared to the current static approaches.

Characterizing MEGACO Security in the presence Diameter Server

This paper analyzes performance of MEGACO (Media Gateway Control Protocol) based on Diameter which is an Authentication, Authorization,andAccounting (AAA) protocol developed within the Internet Engineering Task Force(IETF).Diameter is loosely based on Remote Authentication Dial In User Service (RADIUS), which has previously been used to provide AAA services for dial-up and terminal server access environments. An analytical model is provided for the performance of a MEGACO network while there is a Diameter server to guarantee Authentication in call flow. Ultimately, the M/M/c and M/D/c traffic models are provided to evaluate QoS (Quality of Service) in the call flow and some of the key performance benchmarks response time to process the MEGACO calls and mean number of jobs in the system when there is security mechanism is studied.

Adaptive Authentication And Registration Key Management Scheme Based On AAA Architecture

Abstract The demand for mobile communications has been increasing significantly while inducing more challenges to security issues, especially in authenticating mobile hosts. In order to provide secure communications in mobile networks, the Authentication, Authorization, and Accounting (AAA) architecture is currently in use within the Internet access service. The AAA architecture is used to establish authentication between the communication hosts. However, the current azchitecture has an inefficient authentication procedure when a mobile host hands off from a home domain to foreign domains because the architecture assumes that the only reliable source of authenticating the mobile host is the AAA server located in the home domain. This problem becomes more significant when the mobile host traveling far way from its home domain establishes a mobility security association with mobility entities. To solve these problems, we propose in this paper an adaptive authentication and registration key management scheme...

On the architecture of Authentication, Authorisation, and Accounting for real-time secondary market services

The research community introduced the concept of real-time secondary markets, where licensees are allowed to temporarily lease the spectrum unused by the primary users to secondary users. To support this, an Authentication, Authorisation, and Accounting (AAA) mechanism must be in place to enable the licensees and secondary users to trade spectrum in a real-time manner. In this paper, we present an AAA system architecture, and propose a set of mechanisms to authenticate and authorise secondary users, synchronise multiple secondary devices, and manage real-time secondary market services. Furthermore, we address the accounting issue and examine the pricing strategies associated with accounting.

A secure peer-to-peer backup service keeping great autonomy while under the supervision of a provider

Making backup is so cumbersome and expensive that individuals hardly ever backup their data and companies usually duplicate their data into a secondary server. This paper proposes a novel Peer-to-Peer (P2P) backup system known as the SecureBackup service, which was defined in the DisPairse research project. It utilizes the unused personal hard disk spaces attached to the Internet to implement a distributed backup service that is reliable, performant, and secure. Additionally to the existing approaches like pStore ( Batten et al., 2001), Pastiche ( Landon et al., 2002), and PeerStore ( Landers et al., 2004), addressing the integrity, confidentiality and availability of data in a P2P backup system, the SecureBackup service implements the access control of the peers to the service, the detection of malicious peers, the evaluation of the reliability level of each peer, the rewarding or charging of the peers for the consumed resources or the resources they made available, and the incentives for peers to actively participate to the service. SecureBackup is mainly characterized by a newly meta-data structure for backup file, and a centralized node, under the control of the service provider, which supervises the Authentication, Authorization and Accounting (AAA) services and the operations of the system. While designing a centralized architecture, we paid attention to preserve the autonomy of the P2P backup service. According to some experiments made on few peer nodes, we are confident that the introduced security mechanisms do not much penalize the performances of the system.

On predictive routing of security contexts in an all‐IP network

AbstractWhile mobile nodes (MNs) undergo handovers across inter‐wireless access networks, their security contexts must be propagated for secure re‐establishment of on‐going application sessions, such as those in secure mobile internet protocol (IP), authentication, authorization, and accounting (AAA) services. Routing security contexts via an IP network either on‐demand or based on MNs' mobility prediction, imposes new challenging requirements of secure cross‐handover services and security context management. In this paper, we present a context router (CXR) that manages security contexts in an all‐IP network, providing seamless and secure handover services for the mobile users that carry multimedia‐access devices. A CXR is responsible for (1) monitoring of MNs' cross‐handover, (2) analysis of MNs' movement patterns, and (3) routing of security contexts ahead of MNs' arrival at relevant access points. The predictive routing reduces the delay in the underlying security association that would otherwise fetch an involved security context from a remote server. The predictive routing of security contexts is performed based on statistical learning of MNs' movement pattern, gauging (dis)similarities between the patterns obtained via distance measurements. The CXR has been evaluated with a prototypical implementation based on an MN mobility model on a grid. Our evaluation results support the predictive routing mechanism's improvement in seamless and secure cross‐handover services by a factor of 2.5. Also, the prediction mechanism is shown to outperform the Kalman filter‐based method [13] as a Kalman Fiter‐based mechanism up to 1.5 and 3.6 times regarding prediction accuracy and computation performance, respectively. Copyright © 2009 John Wiley & Sons, Ltd.