Extensible Authentication Protocol Method Research Articles

A secure n-secret based client authentication protocol for 802.11 WLANs

Authentication has strong impact on the overall security model of every information system. Various authentication techniques are available for restricting the access of unauthorized users to the enterprise scale networks. IEEE 802.1X defines a secure and reliable authentication framework for 802.11 WLANs, where Extensible Authentication Protocol (EAP) provides the base to this architecture. EAP is a generic architectural framework which supports extensibility by incorporating the new and improved authentication schemes, which are based on different types of credentials. Currently there exist a number of EAP and Non-EAP methods with varying level of security and complexity. In this work, we have designed a new n-secret based authentication scheme referred here as Personal Dialogue Based Authentication, for the client authentication to the network. It is a Transport Layer Security (TLS) protected authentication protocol, which will be executed inside the secure TLS tunnel for providing the privacy and credential security to the wireless client. The developed authentication protocol has a reasonable set of features like; strong security, user privacy, simplicity and extensibility. For the formal analysis of the protocol we have used SPAN–AVISAP model checker on Ubuntu platform for validating the realization of the specified security goals. The experimental results obtained by simulation performed with the Automated Validation of Internet Security Protocols and Applications (AVISPA) tool shows that our protocol is efficient and secured.

Enhancing EAP-TLS authentication protocol for IEEE 802.11i

IEEE 802.11i authentication framework is composed of the 802.1x and an extensible authentication protocol (EAP) mechanism. One of the most applicable techniques in the EAP methods is EAP-transport layer security (EAP-TLS). The EAP-TLS implementation issues are high execution time; high number of data exchanges between two parties and possibility of closing connection as a result of modification in the contents of the handshake messages, which are all addressed in this paper. This research analyses the EAP-TLS in WLANs to improve this method's efficiency in terms of the security analysis, time and memory usage. Based on the results, this research proposes an enhanced method with a discrete cryptographic mechanisms and a distinct handshake structure, which reduces the number of steps in the handshake protocol. This enhanced method also provides robust security compared to the original EAP-TLS with approximately the same level of memory usage, which reduces execution time significantly.

Compact Extensible Authentication Protocol for the Internet of Things: Enabling Scalable and Efficient Security Commissioning

Internet of Things security is one of the most challenging parts of the domain. Combining strong cryptography and lifelong security with highly constrained devices under conditions of limited energy consumption and no maintenance time is extremely difficult task. This paper presents an approach that combines authentication and bootstrapping protocol (TEPANOM) with Extensible Authentication Protocol (EAP) framework optimized for the IEEE 802.15.4 networks. The solution achieves significant reduction of network resource usage. Additionally, by application of EAP header compacting approach, further network usage savings have been reached. The EAP-TEPANOM solution has achieved substantial reduction of 42% in the number of transferred packets and 35% reduction of the transferred data. By application of EAP header compaction, it has been possible to achieve up to 80% smaller EAP header. That comprises further reduction of transferred data for 3.84% for the EAP-TEPANOM method and 10% for the EAP-TLS-ECDSA based methods. The results have placed the EAP-TEPANOM method as one of the most lightweight EAP methods from ones that have been tested throughout this research, making it feasible for large scale deployments scenarios of IoT.

Complete EAP Method: User Efficient and Forward Secure Authentication Protocol for IEEE 802.11 Wireless LANs

It is necessary to authenticate users who attempt to access resources in Wireless Local Area Networks (WLANs). Extensible Authentication Protocol (EAP) is an authentication framework widely used in WLANs. Authentication mechanisms built on EAP are called EAP methods. The requirements for EAP methods in WLAN authentication have been defined in RFC 4017. To achieve user efficiency and robust security, lightweight computation and forward secrecy, excluded in RFC 4017, are desired in WLAN authentication. However, all EAP methods and authentication protocols designed for WLANs so far do not satisfy all of the above properties. This manuscript will present a complete EAP method that utilizes stored secrets and passwords to verify users so that it can 1) fully meet the requirements of RFC 4017, 2) provide for lightweight computation, and 3) allow for forward secrecy. In addition, we also demonstrate the security of our proposed EAP method with formal proofs.

A Moderate Weight EAP Authentication Method (EAP-MEAP) for Wireless Local Area Network

Summary IEEE 802.11standard for Wireless Local Area Networks (WLANs) is facing more and more problems linked to security threats, which expose legitimate users to increased risk. Therefore, the security is always a major concern for WLAN development and one of the major challenges in WLAN security issue is authentication. Extensible Authentication Protocol (EAP) has been widely used for that important aspect. EAP is a framework of authentication process that uses several methods to perform that process. In this paper, we will analyze and show up the flows of the existing EAP methods. Then, we will propose a new EAP method Extensible Authentication Protocol -Moderate Weight Extensible Authentication Protocol “EAP-MEAP”. This method combines between the simplicity of deployment and management of password methods and the robustness of certificated ones. EAP-MEAP can be used widely in IEEE802.11 for WLANs (Wi- Fi and its application domains) as solution to the presented flaws. We present a security assessment to our proposed protocol. Finally, we have checked and verified the EAP- MEAP security properties using the specialized model checker AVISPA, which provides formal proofs of the security protocols.

The Concept of Extensible Authentication Protocol for Mobile Equipment to Heterogeneous Network (EAP-M2H)

Extensible Authentication Protocol (EAP) is a universal authentication framework defined by RFC3748 and updated by RFC5247. It is not a specific authentication mechanism for exclusive system and then the widespread acceptance and implementation in wireless networks or other Point-to-Point (P2P) connections. A number of vendor specific EAP methods were proposed for special purpose such as EAP-MD5, EAP-TLS, EAP-TTLS, EAP-PEAP, LEAP, SPEKE, EAP-SIM, EAP-AKA, EAP-FAST, and so on. All of them have a common characteristic that the client submitted his Security Association (SA) to the neighbor Access Point (AP), then AP forward it to identify his validity by Authentication Authorization Accounting (AAA) server of both sides. Although these EAPs are design to meet the widespread authentication demands. But in fact they have the independent authentication procedure respectively. That is they are incompatible with each other. For mobile devices, in order to meet the needs of different connection it had to support many of the EAPs. This situation for the most mobile devices is a heavy load and result the inconvenient which move in the different service network. This paper devotes in solves this situation. For this goal, an extensible authentication protocol for mobile equipment to heterogeneous network (EAP-M2H) is provided in the paper. EAP-M2H development from the EAP-AKA and improve their applicability and compatibility in heterogeneous network.

A self-adaptive K selection mechanism for re-authentication load balancing in large-scale systems

Since the 802.16e standard has been released, there are few authentication pattern schemes and Extensible Authentication Protocol (EAP) selection proposals for manufacturers to choose from in large-scale network systems. This paper focuses on the re-authentication method's design, improvement, and optimization for the PMP mode of the IEEE 802.16e standard in large-scale network systems to ensure the security of the keys. We first present an optimized scheme, called EAP_AKAY, based on the EAP-AKA authentication method (Arkko and Haverinen in Extensible Authentication Protocol Method for UMTS Authentication and Key Agreement (EAP-AKA), 2004), and then a self-adaptive K selection mechanism is proposed for re-authentication load balancing based on EAP_AKAY in large-scale network systems. This presented mechanism considers the cost of authentication, not only at the server end, but also at the client end. Thus, this scheme would minimize the total cost and resolve the limitation in current schemes. Furthermore, the K value would be re-selected, not only when MS is roaming to another BS region, but also in residing time to adapt to network environment changes. The simulation results and relevant analysis demonstrate that our scheme is effective in terms of the total cost of authentication, master key renewal, and good security.

Extensible Authentication Protocol Overview and Its Applications

The Extensible Authentication Protocol (EAP) is an authentication framework that supports multiple authentication mechanisms [38] between a peer and an authentication server in a data communication network. EAP is used as a useful tool for enabling user authentication and distribution of session keys. There are numerous EAP methods that have been developed by global SDOs such as IETF, IEEE, ITU-T, and 3GPP. In this paper, we analyze the most widely deployed EAP methods ranging from the EAP-TLS [27] to the EAP-PSK [25]. In addition, we derive the security requirements of EAP methods meet, evaluate the typical EAP methods in terms of the security requirements, and discuss the features of the existing widely-deployed EAP methods. In addition, we identify two typical use cases for the EAP methods. Finally, recent global standardization activities in this area are reviewed.

EAP methods for wireless networks

This paper presents an overview and analysis of Extensible Authentication Protocol (EAP) and its place in securing wireless LANs. A number of specific widely used EAP methods are examined and evaluated for their advantages and susceptibility to types of attack. Next we propose suitable EAP methods for wireless technologies beyond LANs, including RFID and WiMAX. After analyzing requirements for different wireless networks, we conclude that a new lightweight and secure EAP method is warranted for fixed mobile convergence interoperability.

How to Establish Secure Channels for Wireless Communications

The most fundamental security goals include authentication and confidentiality both of which can be achieved by an authenticated key establishment (so-called AKE) protocol where the involving parties authenticate each other and generate cryptographically-secure (but temporal) session keys for their subsequent secure channels. As AKE protocols for wireless security, the IEEE 802.1x standard committee employed the Extensible Authentication Protocol (EAP) methods: EAP-MD5, LEAP, EAP-SIM, EAP-AKA, EAP-TLS, EAP-TTLS and PEAP. In this paper, we first revisit the EAP methods considering the following practical situation: (1) a user, who communicates with many different servers, remembers only one password and has insecure mobile devices (e.g., mobile phones or PDAs) with very-restricted computing power and built- in memory capacity; (2) the counterpart servers have enormous computing power, but they are not perfectly secure against various attacks (e.g., virus or hacker); (3) neither PKI (Public Key Infrastructures) nor TRM (Tamper-Resistant Modules) is available. For the above situation, we introduce an RSA-based AKE (for short, RSA-AKE) protocol that satisfies both higher level of security and efficiency over their kinds.