Extensible Authentication Protocol Research Articles

A secure group based authentication protocol for machine to machine communications in LTE-WLAN interworking architecture

Machine to Machine (M2M) communication has been used in applications such as telemetry, industry, automation and health. Support for a large number of devices has been considered an essential requirement in M2M communications. During this time, security is the most important challenge; M2M cannot access secure networks through effective authentication, all relevant M2M applications cannot be accepted. The challenge of M2M research is authentication by the group when a large number of M2M devices simultaneously accessing the network will cause severe authentication signaling congestion. The group based model under an M2M architecture, especially when the Machine Type Communication (MTC) devices belong to the non 3rd Generation Partnership Project (3GPP) network, will face a new challenge of access authentication. In this paper, we propose a group based authentication and key agreement protocol for machine type communications combining Elliptic Curve based Diffie-Hellman (ECDH) on the Extensible Authentication Protocol (EAP). Compared to EAP-AKA and other existing authentication protocols, our solution provides increased security against various malicious activities and better performance in terms of signaling overhead, bandwidth consumption and transmission cost.

Wireless access point protection from un-authorized user in an office environment

Extensible Authentication Protocol (EAP) is authentication method to protect wireless local area network from un-authorized user which there was interaction between radius servers, access point and client device. When EAP was used as authentication method, the authentication can be strengthened by using TLS (Transport Layer Security) certificate where client device and server will use certificate to verify the identity of each other. The certificate must meet requirement on the server and client for the successful authentication. For this time, the authentication method provides highest level for security in wireless local area network because this method can protect man-in-middle vulnerability.The proposed framework is evaluated by using scenario in testing and live environment to ensure that the authentication has been securely for mutual device authentication.

OAP-WMN: optimised and secure authentication protocol for wireless mesh networks

Wireless mesh networks (WMN) proposes many attractive features to mobile networking area such as: self-reconfiguration and self-organisation which make it more flexible, easy deployed and not expensive. But, these features make it constantly overwhelmed with different types of security threats. In this article, we propose an optimised and secure authentication and re-authentication schemes based on the extensible authentication protocol (EAP) mechanism. The proposed solution ensures security of WMN handoff and with a better QoS. It achieves this by reducing the number of exchanging messages and computations in the proposed authentication and re-authentication processes. Besides, we choose to secure the link layer that makes the authentication process more efficient and optimised. For performance evaluation, we use the OPENSSL tool to compare our work with some related work and the result is good. Moreover, the security of our authentication scheme has been affirmed with the AVISPA tool.

OAP-WMN: optimised and secure authentication protocol for wireless mesh networks

Wireless mesh networks (WMN) proposes many attractive features to mobile networking area such as: self-reconfiguration and self-organisation which make it more flexible, easy deployed and not expensive. But, these features make it constantly overwhelmed with different types of security threats. In this article, we propose an optimised and secure authentication and re-authentication schemes based on the extensible authentication protocol (EAP) mechanism. The proposed solution ensures security of WMN handoff and with a better QoS. It achieves this by reducing the number of exchanging messages and computations in the proposed authentication and re-authentication processes. Besides, we choose to secure the link layer that makes the authentication process more efficient and optimised. For performance evaluation, we use the OPENSSL tool to compare our work with some related work and the result is good. Moreover, the security of our authentication scheme has been affirmed with the AVISPA tool.

Multihop Bootstrapping With EAP Through CoAP Intermediaries for IoT

In the renowned Internet of Things (IoT) networks, it is expected a vast number of devices with IP connectivity and constrained capabilities. Due to reduced resources they are the target of different type of attacks and providing security has become a basic pillar for the success and evolution of IoT. Among the specific key security aspects are the authentication, access control and key distribution for data protection. In particular, all these aspects are included in the process of bootstrapping , which allows a Smart Object to join a network domain in a secure fashion. This process, which indeed involves authentication, authorization, and key distribution, typically requires communication between the smart object and an entity, the Controller , in charge of steering the bootstrapping process within the network’s domain. However, direct communication between both might be impeded, e.g., when the entity is unreachable by radio, or the smart object does not have a routable IP address until it is successfully authenticated and authorized to join the network. A common solution is to use an intermediate entity (the Intermediary ) to aid in this task. For example, the ZigBee IP standard defines a relay for the protocol for carrying authentication for network access (PANA). Moreover, the IETF is exploring the use of an intermediary to help this process. In this paper, we analyze, explore, and design an intermediary based on constrained application protocol (CoAP). We pay attention to the authentication with the extensible authentication protocol (EAP) and CoAP, which has resulted in a more constrained alternative to PANA for EAP-based bootstrapping in IoT. Nevertheless, our design of the CoAP-based intermediary is so general that it is independent of the authentication protocol in use. In particular, we have analyzed as intermediary the usage of a CoAP proxy , as defined in the CoAP standard; alternatively we have introduced the concept of the CoAP relay and CoAP stateless proxy . We evaluate the performance of each solution and we compare between them and with PANA relay.

Обзор расширяемого протокола аутентификации и его методов

Обзор расширяемого протокола аутентификации и его методов

A CoAP-Based Network Access Authentication Service for Low-Power Wide Area Networks: LO-CoAP-EAP.

The Internet-of-Things (IoT) landscape is expanding with new radio technologies. In addition to the Low-Rate Wireless Personal Area Network (LR-WPAN), the recent set of technologies conforming the so-called Low-Power Wide Area Networks (LP-WAN) offers long-range communications, allowing one to send small pieces of information at a reduced energy cost, which promotes the creation of new IoT applications and services. However, LP-WAN technologies pose new challenges since they have strong limitations in the available bandwidth. In general, a first step prior to a smart object being able to gain access to the network is the process of network access authentication. It involves authentication, authorization and key management operations. This process is of vital importance for operators to control network resources. However, proposals for managing network access authentication in LP-WAN are tailored to the specifics of each technology, which could introduce interoperability problems in the future. In this sense, little effort has been put so far into providing a wireless-independent solution for network access authentication in the area of LP-WAN. To fill this gap, we propose a service named Low-Overhead CoAP-EAP (LO-CoAP-EAP), which is based on previous work designed for LR-WPAN. LO-CoAP-EAP integrates the use of Authentication, Authorization and Accounting (AAA) infrastructures and the Extensible Authentication Protocol (EAP) protocol. For this integration, we use the Constrained Application Protocol (CoAP) to design a network authentication service independent of the type of LP-WAN technology. LO-CoAP-EAP represents a trade-off between flexibility, wireless technology independence, scalability and performance in LP-WAN.

An efficient EAP‐based proxy signature handover authentication scheme for WRANs over TV white space

SummaryThe wireless regional area networks (WRANs) operates in the very high frequency and ultra high frequency television white space bands regulated by the IEEE 802.22 standard. The IEEE 802.22 standard supports Extensible Authentication Protocol (EAP)‐based authentication scheme. Due to the participation of a server and the information exchanged between a customer primes equipment and the secondary user base station, it takes around 50 ms to complete a complete EAP authentication that cannot be accepted in a handover procedure in WRANs. In this paper, we propose an EAP‐based proxy signature (EPS) handover authentication scheme for WRANs. The customer primes equipment and secondary user base station accomplish a handover authentication without entailing the server by using the proxy signature. Approved by the logic derivation by Burrows, Abadi, and Needham logic and formal verification by Automated Validation of Internet Security Protocols and Applications, we can conclude that the proposed EPS scheme can obtain mutual authentication and hold the key secrecy with a strong antiattack ability. Additionally, the performance of the EPS scheme in terms of the authentication delay has been investigated by simulation experiments with the results showing that the EPS scheme is much more efficient in terms of low computation delay and less communication resources required than the security scheme regulated in IEEE 802.22 standard.

ADVANCED ENCRYPTION AND EXTENDED AUTHENTICATION FOR WIRELESS LAN

Wireless networking technology is becoming increasingly popular but, at the same time, has introduced many security issues. WEP standards are followed in WLANs for providing security. But WEP is fatally crippled by the fact that WEP keys are the same for all users, all sessions and never changes and its poor implementation of the RC4 encryption scheme. The authentication mechanism is based on a simple challenge-response protocol. The main problem with the previously used method was same key was used for both encryption and authentication. But the proposed authentication is by means of certificates using Extensible Authentication Protocol and a session key is transferred after successful authentication between mobile node and server. This session key is then used for encrypting messages using Advanced Encryption Standard between mobile node and server.

An Efficient EAP-Based Pre-Authentication for Inter-WRAN Handover in TV White Space

The IEEE 802.22 standard regulates wireless regional area network (WRAN) operating at the very high frequency and ultrahigh frequency television white space (TVWS) bands. WRAN supports extensible authentication protocol (EAP)-based authentication schemes. However, due to its public key cryptography operations, a full EAP-based authentication scheme is time-consuming, which is unacceptable for the WRAN handover process. In this paper, an efficient EAP-based pre-authentication scheme for inter-WRAN handovers (EPW) in TVWS is proposed. By applying the proposed pre-authentication scheme, the customer premises equipment and the target secondary user base station can accomplish a seamless handover using symmetric key. Through logic derivation by Burrows, Abadi, and Needham logic and formal verification by automated validation of Internet security protocols and applications, we conclude that the proposed EPW scheme can obtain mutual authentication and maintain key secrecy with a high resistance to attack. Additionally, the performance of the EPW scheme has been investigated by simulation experiments. The results show that the EPW scheme provides a lower computation delay than that mandated by the security scheme regulation of the IEEE 802.22 standard.

Lightweight CoAP-Based Bootstrapping Service for the Internet of Things.

The Internet of Things (IoT) is becoming increasingly important in several fields of industrial applications and personal applications, such as medical e-health, smart cities, etc. The research into protocols and security aspects related to this area is continuously advancing in making these networks more reliable and secure, taking into account these aspects by design. Bootstrapping is a procedure by which a user obtains key material and configuration information, among other parameters, to operate as an authenticated party in a security domain. Until now solutions have focused on re-using security protocols that were not developed for IoT constraints. For this reason, in this work we propose a design and implementation of a lightweight bootstrapping service for IoT networks that leverages one of the application protocols used in IoT : Constrained Application Protocol (CoAP). Additionally, in order to provide flexibility, scalability, support for large scale deployment, accountability and identity federation, our design uses technologies such as the Extensible Authentication Protocol (EAP) and Authentication Authorization and Accounting (AAA). We have named this service CoAP-EAP. First, we review the state of the art in the field of bootstrapping and specifically for IoT. Second, we detail the bootstrapping service: the architecture with entities and interfaces and the flow operation. Third, we obtain performance measurements of CoAP-EAP (bootstrapping time, memory footprint, message processing time, message length and energy consumption) and compare them with PANATIKI. The most significant and constrained representative of the bootstrapping solutions related with CoAP-EAP. As we will show, our solution provides significant improvements, mainly due to an important reduction of the message length.

On the authentication and re‐authentication protocols in LTE‐WLAN interworking architecture

AbstractFor mobile users, interworking environment composed of Long Term Evolution (LTE) and wireless local area network (WLAN) has become a practical consideration. As a prevalent technology, LTE has desirable features that support high data rate, mobile capabilities, good quality of service and wide coverage area. On the other hand, WLAN network provides higher bit rate but weaker mobility support. Additional features such as cost effectiveness on covering signal‐deadzones of LTE networks and its plentiful bandwidth for better good quality of service make the WLAN a complementary solution for LTE networks. Accordingly, the combination of both technologies would provide better system with higher privilege to both users and service providers. Recent development in LTE‐WLAN interworking has led to a need of authentication protocols that can provide secure and seamless handover process among such networks. Several studies have modified the existing authentication protocols, but they are limited to 3G‐WLAN interworking architecture. Besides, most of the existing authentication schemes are complex and vulnerable to network attacks (e.g. user identity disclosure). Extensible Authentication Protocol with improved authentication and key agreement protocol is introduced in this paper to present the new inter‐re‐authentication and intra‐re‐authentication protocols specified for the LTE‐WLAN interworking architecture. The proposed protocols are verified using Automated Validation of Internet Security Protocols and Applications, and the performances are evaluated in terms of energy consumption, authentication delay and signalling cost. The results indicate that the proposed protocols are more secure and efficient compared with standard protocols. Copyright © 2016 John Wiley & Sons, Ltd.

Enhancing EAP-TLS authentication protocol for IEEE 802.11i

IEEE 802.11i authentication framework is composed of the 802.1x and an extensible authentication protocol (EAP) mechanism. One of the most applicable techniques in the EAP methods is EAP-transport layer security (EAP-TLS). The EAP-TLS implementation issues are high execution time; high number of data exchanges between two parties and possibility of closing connection as a result of modification in the contents of the handshake messages, which are all addressed in this paper. This research analyses the EAP-TLS in WLANs to improve this method's efficiency in terms of the security analysis, time and memory usage. Based on the results, this research proposes an enhanced method with a discrete cryptographic mechanisms and a distinct handshake structure, which reduces the number of steps in the handshake protocol. This enhanced method also provides robust security compared to the original EAP-TLS with approximately the same level of memory usage, which reduces execution time significantly.

Reduced Overhead Frequent User Authentication in EAP-Dependent Broadband Wireless Networks

The authentication mechanisms in Broadband Wireless Networks (BWN) are predominantly based on Extensible Authentication Protocol (EAP). However, the complexity of EAP causes an impediment in BWN networks which involve high speed mobility. Even though it provides a highly secured mechanism, the current authentication process has high authentication overheads which affect the Quality of Service (QoS) in time sensitive data applications such as VoIP and VoD. The alternative would be to consider re-authentication approach which reduces the number of full EAP authentications but at the same time provides a secure handoff to the mobile users at a lower latency and hence does not impact the QoS of the applications. The proposed Frequency-based Re-authentication Protocol (FRP) is an extension to EAP, aiming to reduce the network access time and in turn reduce the authentication latency, by taking into account the frequency of visits of a particular mobile user to an access domain. In addition, we also propose a frequent --- User Authentication Process (f-UAP) which when used with FRP significantly minimizes the EAP authentication overhead. A mathematical model is formulated to illustrate the tradeoff achieved when FRP along with EAP is used in the f-UAP approach. The security evaluation of the proposed FRP is carried out using Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. Furthermore, simulation analysis show that the FRP authentication latency is lower compared to the existing re-authentication mechanisms.

Security Enhancement for LTE Authentication Protocol (EPS-AKA)

In Long Term Evolution (LTE) networks Extensible Authentication Protocol (EAP) is an authentication framework, not a specific authentication mechanism. EAP-AKA is one of the methods of EAP which uses the Authentication and Key Agreement (AKA) mechanism based on challenge-response mechanisms, EAP-AKA is used in the 3rd generation mobile networks then modified and inherited to 4th generation mobile networks (LTE) as Evolved Packet System Authentication and Key Agreement (EPS-AKA) mechanism. EPS-AKA vulnerabilities are disclosure of the user identity, Man in the Middle attack and Denial of Services (DoS) attacks so a robust authentication mechanism must replace EPS-AKA to avoid such attacks. In this paper, Modified Evolved Packet System Authentication and Key Agreement (MEPS-AKA) protocol based on Simple Password Exponential Key Exchange (SPEKE) is proposed to solve these problems. Scyther tool is used to verify the efficiency of the proposed protocol against the mentioned attacks. EPS-AKA and MEPS-AKA are simulated using C programming language to calculate the execution time for both algorithms.

A Novel ID-Based Authentication and Key Exchange Protocol Resistant to Ephemeral-Secret-Leakage Attacks for Mobile Devices

With the rapid development in wireless communications and cloud computing technologies, clients (users) often use handheld mobile devices to access remote servers via open network channels. To provide authentication and confidentiality between clients and servers, a large number of ID-based authentication and key exchange (ID-AKE) protocols have been proposed for mobile client-server environments. However, most of the existing ID-AKE protocols adopt the precomputation technique so that they become vulnerable to the ephemeral-secret-leakage (ESL) attacks, in the sense that an adversary could use the ephemeral secrets to reveal the private keys of clients from the corresponding exchange messages. In the paper, we propose a new ESL-secure ID-AKE protocol for mobile client-server environments. We formally prove that the proposed protocol satisfies the security requirements of both mutual authentication and key exchange while resisting the ESL attacks. When compared with previously proposed ID-AKE protocols, our protocol has higher security and retains computational performance, since it requires no bilinear pairing operation for mobile clients. Finally, we mention the possibility of adopting our protocol as an authentication method of the extensible authentication protocol (EAP) for wireless networks.

Opportunistic mobility support for resource constrained sensor devices in smart cities.

A multitude of wireless sensor devices and technologies are being developed and deployed in cities all over the world. Sensor applications in city environments may include highly mobile installations that span large areas which necessitates sensor mobility support. This paper presents and validates two mechanisms for supporting sensor mobility between different administrative domains. Firstly, EAP-Swift, an Extensible Authentication Protocol (EAP)-based sensor authentication protocol is proposed that enables light-weight sensor authentication and key generation. Secondly, a mechanism for handoffs between wireless sensor gateways is proposed. We validate both mechanisms in a real-life study that was conducted in a smart city environment with several fixed sensors and moving gateways. We conduct similar experiments in an industry-based anechoic Long Term Evolution (LTE) chamber with an ideal radio environment. Further, we validate our results collected from the smart city environment against the results produced under ideal conditions to establish best and real-life case scenarios. Our results clearly validate that our proposed mechanisms can facilitate efficient sensor authentication and handoffs while sensors are roaming in a smart city environment.

A New Handover Authentication Method for WiMAX Architecture

The Initial Network Entry Authentication (INEA) process is the first security entry between client and WiMAX network. WiMAX architecture provides a significant flexibility to respect wireless security requirements. The INEA framework is based on the Extensible Authentication Protocol (EAP) for user authentication and key management. However, EAP authentication method introduces high authentication delay and signaling cost when the user moves between stations. These impact negatively the handover process and decrease the Quality of Service of WiMAX networks. In this paper, we analyze the existing INEA authentication process and we propose a new authentication method and key agreement for handovers process. To prove the new method validity, the verification is performed by using the formal security analyzer Automated Validation of Internet Security Protocols and Applications which is a performed tool to find automatically potential attacks in security protocols. Furthermore, the proposed protocol is compared with other handover protocols. The comparison shows that proposed protocol outperforms the other protocols.

공장 및 생산 자동화에 있어 안드로이드 기반의 보안성이 강화된 모바일장비관리시스템 구현

안드로이드 기반의 스마트폰을 공장자동화 및 생산자동화 분야에서의 활용이 중요하게 여겨지고 있다. 일반적으로 OMA DM 표준은 공장자동화 및 생산자동화 환경을 위한 중요한 인프라 구조 기술이다. 본 논문에서는 OMA DM 플랫폼 설계 및 구현에 대해 연구한다. 개발된 프로토타입은 세 가지 모듈 즉 DMS, FUMO 그리고 SCOMO로 구성된다. 그리고 EAP 및 AES 개념을 응용한 보안 모듈도 제시되었다. 제안된 보안 모듈은 공장자동화를 위해 안드로이드 기반의 스마트폰을 활용한 DMS, FUMO 및 SCOMO 모듈 간 통신에서 안전한 통신을 보장하기 위해 적용된다. 시뮬레이션 결과에 의하면 구현된 해당 프로토타입은 공장자동화 환경에서 좋은 성능을 보이며 보안성을 보장하면서 여러 공장자동화, 생산자동화 및 사무자동화 환경에서 활용이 가능하다. Utilizing smart phones based on android applications in the field of FA(Factory Automation) or PA(Production Automation) is being deployed actively. In general, MDM(Mobile Device Management) is a crucial infra-structure to build such a FA or PA environment. In this paper, we suggest an open mobile device management platform and implement its prototype. The developed prototype consists of three modules such as DMS(Device Management Server), FUMO(Firmware Update Management Object) and SCOMO(Software Component Management Object). In addition, we suggest a security module based on the concept of the EAP (Extensible Authentication Protocol) and the AES (Advanced Encryption Standard). The suggested security module's prototype is applied to guarantee the data integrity in the process of communicating among DMS, FUMO and SCOMO for the purpose of utilizing smart phones based on android applications in a FA field. We also evaluate the performance of the implemented security prototype. According to our simulation results, the implemented prototype has a good performance in a FA environment and can be utilized in the other FA, PA or OA(Office Automation) environment with guaranteeing the security.

End-to-End Authentication Protocols for Personal/Portable Devices over Cognitive Radio Networks

Recent Federal Communications Commission rules promise a whole new set of possible applications, which allow unlicensed use on a secondary basis of the Television White Spaces (TVWS), called as cognitive radio technology. ECMA-International launched the first step towards realizing these applications by creating and adopting industry standards. This paper reviews the first industrial standards for personal/portable devices in the TVWS from ECMAInternational focused on the security aspects. After that, we point out the lack of security facilities in the standard, which does support the link-to-link security but not for the end-toend security, and then propose two location-based authentication protocols to cope up with the deficiencies over cognitive radio networks. We use location information as thesecurecredentialfor the authentications. The protocols can be support privacy issues of consumer premise equipments and integrated into the extensible authentication protocol.