Extensible Authentication Protocol Authentication Research Articles

Enterprise Security for the Internet of Things (IoT): Lightweight Bootstrapping with EAP-NOOB.

The emergence of radio technologies, such as Zigbee, Z-Wave, and Bluetooth Mesh, has transformed simple physical devices into smart objects that can understand and react to their environment. Devices, such as light bulbs, door locks, and window blinds, can now be connected to, and remotely controlled from, the Internet. Given the resource-constrained nature of many of these devices, they have typically relied on the use of universal global shared secrets for the initial bootstrapping and commissioning phase. Such a scheme has obvious security weaknesses and it also creates undesirable walled-gardens where devices of one ecosystem do not inter-operate with the other. In this paper, we investigate whether the standard Extensible Authentication Protocol (EAP) framework can be used for secure bootstrapping of resource-constrained devices. EAP naturally provides the benefits of per-device individual credentials, straightforward revocation, and isolation of devices. In particular, we look at the Nimble out-of-band authentication for EAP (EAP-NOOB) as a candidate EAP authentication method. EAP-NOOB greatly simplifies deployment of such devices as it does not require them to be pre-provisioned with credentials of any sort. Based on our implementation experience on off-the-shelf hardware, we demonstrate that lightweight EAP-NOOB is indeed a way forward to securely bootstrap such devices.

An efficient EAP‐based proxy signature handover authentication scheme for WRANs over TV white space

SummaryThe wireless regional area networks (WRANs) operates in the very high frequency and ultra high frequency television white space bands regulated by the IEEE 802.22 standard. The IEEE 802.22 standard supports Extensible Authentication Protocol (EAP)‐based authentication scheme. Due to the participation of a server and the information exchanged between a customer primes equipment and the secondary user base station, it takes around 50 ms to complete a complete EAP authentication that cannot be accepted in a handover procedure in WRANs. In this paper, we propose an EAP‐based proxy signature (EPS) handover authentication scheme for WRANs. The customer primes equipment and secondary user base station accomplish a handover authentication without entailing the server by using the proxy signature. Approved by the logic derivation by Burrows, Abadi, and Needham logic and formal verification by Automated Validation of Internet Security Protocols and Applications, we can conclude that the proposed EPS scheme can obtain mutual authentication and hold the key secrecy with a strong antiattack ability. Additionally, the performance of the EPS scheme in terms of the authentication delay has been investigated by simulation experiments with the results showing that the EPS scheme is much more efficient in terms of low computation delay and less communication resources required than the security scheme regulated in IEEE 802.22 standard.

Reduced Overhead Frequent User Authentication in EAP-Dependent Broadband Wireless Networks

The authentication mechanisms in Broadband Wireless Networks (BWN) are predominantly based on Extensible Authentication Protocol (EAP). However, the complexity of EAP causes an impediment in BWN networks which involve high speed mobility. Even though it provides a highly secured mechanism, the current authentication process has high authentication overheads which affect the Quality of Service (QoS) in time sensitive data applications such as VoIP and VoD. The alternative would be to consider re-authentication approach which reduces the number of full EAP authentications but at the same time provides a secure handoff to the mobile users at a lower latency and hence does not impact the QoS of the applications. The proposed Frequency-based Re-authentication Protocol (FRP) is an extension to EAP, aiming to reduce the network access time and in turn reduce the authentication latency, by taking into account the frequency of visits of a particular mobile user to an access domain. In addition, we also propose a frequent --- User Authentication Process (f-UAP) which when used with FRP significantly minimizes the EAP authentication overhead. A mathematical model is formulated to illustrate the tradeoff achieved when FRP along with EAP is used in the f-UAP approach. The security evaluation of the proposed FRP is carried out using Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. Furthermore, simulation analysis show that the FRP authentication latency is lower compared to the existing re-authentication mechanisms.

A New Handover Authentication Method for WiMAX Architecture

The Initial Network Entry Authentication (INEA) process is the first security entry between client and WiMAX network. WiMAX architecture provides a significant flexibility to respect wireless security requirements. The INEA framework is based on the Extensible Authentication Protocol (EAP) for user authentication and key management. However, EAP authentication method introduces high authentication delay and signaling cost when the user moves between stations. These impact negatively the handover process and decrease the Quality of Service of WiMAX networks. In this paper, we analyze the existing INEA authentication process and we propose a new authentication method and key agreement for handovers process. To prove the new method validity, the verification is performed by using the formal security analyzer Automated Validation of Internet Security Protocols and Applications which is a performed tool to find automatically potential attacks in security protocols. Furthermore, the proposed protocol is compared with other handover protocols. The comparison shows that proposed protocol outperforms the other protocols.

Efficient and robust identity‐based handoff authentication for EAP‐based wireless networks

SUMMARYThe Extensible Authentication Protocol (EAP) framework aims to realize a flexible authentication for wireless networks. However, a full EAP authentication needs several round trips between a mobile node and the EAP server, and hence is unacceptable in a process of handoff authentication because of inefficient performance. Considering the advantage of the identity‐based cryptography, it is attractive to realize handoff authentication efficiently in the identity‐based setting. In this work, we propose a new identity‐based handoff authentication scheme in which a special double‐trapdoor chameleon hash function is used. Compared with the existing identity‐based handoff authentication construction, the main advantage of the proposed scheme eliminates the assumption that the private key generator is fully trusted. Besides, the detailed security analysis shows that the proposed scheme not only satisfies robust security properties but also enjoys desirable efficiency for the real‐world applications. Copyright © 2013 John Wiley & Sons, Ltd.

Complete EAP Method: User Efficient and Forward Secure Authentication Protocol for IEEE 802.11 Wireless LANs

It is necessary to authenticate users who attempt to access resources in Wireless Local Area Networks (WLANs). Extensible Authentication Protocol (EAP) is an authentication framework widely used in WLANs. Authentication mechanisms built on EAP are called EAP methods. The requirements for EAP methods in WLAN authentication have been defined in RFC 4017. To achieve user efficiency and robust security, lightweight computation and forward secrecy, excluded in RFC 4017, are desired in WLAN authentication. However, all EAP methods and authentication protocols designed for WLANs so far do not satisfy all of the above properties. This manuscript will present a complete EAP method that utilizes stored secrets and passwords to verify users so that it can 1) fully meet the requirements of RFC 4017, 2) provide for lightweight computation, and 3) allow for forward secrecy. In addition, we also demonstrate the security of our proposed EAP method with formal proofs.

On the Use of ID-Based Cryptography for the Definition of New EAP Authentication Methods

We propose in this paper, two ID-Based authentication methods for the Extensible Authentication Protocol (EAP), as an alternative to methods relying on Public Key Infrastructure (PKI), to provide nodes with private and public keys. ID-Based Cryptography (IBC) proposes to derive the public key from the node's identity directly. As such, there is no need for deployment of a Certification Authority (CA) and the burdensome management of certificates is removed. IBC relies on a Private Key Generator (PKG) for the computation of stations private keys. Our first presented authentication method corresponds to a situation where the PKG is trustful. As such, the PKG generates the private keys of all the network stations. However, our second contribution presents an authentication method which is resistant to the Key Escrow Attack. That is, we make each station generate its own ID-Based private key. In addition, results from implementation tests are given and prove how efficient IBC might be for use in wireless networks.

New Authentication and Key Agreement Protocol for LTE-WLAN Interworking

New cellular networks are capable of providing high mobility, whereas WLANs are known for having relatively higher bandwidths. Therefore, interworking cellular networks with WLANs offers ubiquitous data services and relatively high data rates across modern networks. This interworking will enable a user to access new cellular services via a WLAN, while roaming within a range of hotspots. To provide secure 3G-WLAN interworking in the SAE/LTE architecture, Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA) is used. However, EAP-AKA has several vulnerabilities. This paper analyzes vulnerabilities in LTE-WLAN interworking and proposes a new authentication and key agreement protocol based on EAP-AKA.

A Moderate Weight EAP Authentication Method (EAP-MEAP) for Wireless Local Area Network

Summary IEEE 802.11standard for Wireless Local Area Networks (WLANs) is facing more and more problems linked to security threats, which expose legitimate users to increased risk. Therefore, the security is always a major concern for WLAN development and one of the major challenges in WLAN security issue is authentication. Extensible Authentication Protocol (EAP) has been widely used for that important aspect. EAP is a framework of authentication process that uses several methods to perform that process. In this paper, we will analyze and show up the flows of the existing EAP methods. Then, we will propose a new EAP method Extensible Authentication Protocol -Moderate Weight Extensible Authentication Protocol “EAP-MEAP”. This method combines between the simplicity of deployment and management of password methods and the robustness of certificated ones. EAP-MEAP can be used widely in IEEE802.11 for WLANs (Wi- Fi and its application domains) as solution to the presented flaws. We present a security assessment to our proposed protocol. Finally, we have checked and verified the EAP- MEAP security properties using the specialized model checker AVISPA, which provides formal proofs of the security protocols.

PKMv2 - EAP authentication cost reduction of mobile WiMAX network entry process by the proposed key caching mechanisms

The much anticipated technology of mobile WiMAX, the worldwide interoperability for microwave access, aims to provide seamless support to its users but an inevitable is that the long delay which occurs during the handoff management in every network process. Secure key distribution is done by private key management version 2 (PKMv2) with extensible authentication protocol (EAP). Handovers may cause delays and packet losses that affect real-time communication performance. Hence, we optimise the services by introducing new ideology in key caching mechanism which minimises the authentication cost and processing time consumes 56.8% than earlier approach. This can be investigated analytically and the network entry process can be simulated through MATLAB GUI model with MySQL as the backend for storing respective ID. The simulation is carried with the network simulator. This paper proposes three types of key caching. This approach is justified through its timing analysis result which indicates that the key caching mechanism can efficiently swift the handoff processes.

Security Enhancement With Optimal QOS Using EAP-AKA In Hybrid Coupled 3G-WLAN Convergence Network

The third generation partnership project (3GPP) has addressed the feasibility of interworking and specified the interworking architecture and security architecture for third generation (3G)-wireless local area network (WLAN), it is developing, system architecture evolution (SAE)/ long term evolution (LTE) architecture, for the next generation mobile communication system. To provide a secure 3G-WLAN interworking in the SAE/LTE architecture, Extensible authentication protocol-authentication and key agreement (EAP-AKA) is used. However, EAP-AKA have several vulnerabilities. Therefore, this paper not only analyses the threats and attacks in 3G-WLAN interworking but also proposes a new authentication and key agreement protocol based on EAP-AKA. The proposed protocol combines elliptic curve Diffie-Hellman (ECDH) with symmetric key cryptosystem to overcome the vulnerabilities. The proposed protocol is used in hybrid coupled 3G-WLAN convergence network to analyse its efficiency in terms of QoS metrics, the results obtained using OPNET 14.5 shows that the proposed protocol outperforms existing interworking protocols both in security and QoS.