Extensible Authentication Protocol Research Articles

USIM-based EAP-TLS authentication protocol for wireless local area networks

Due to the rapid growth in popularity of Wireless Local Area Network (WLAN), wireless security has become one of many important research issues. For the WLAN security, the IEEE 802.1X standard provides an authentication framework that is based on the Extensible Authentication Protocols (EAP). In the EAP framework, there are many authentication protocols that have been proposed, in which each authentication protocol has some strengths and weaknesses, respectively. Most EAP authentication protocols lack two features: identity protection and withstanding man-in-the-middle attacks. In this paper, we first propose a novel symmetric-key based certificate distribution scheme based on Universal Subscriber Identity Module (USIM) cards in a cellular network. The symmetric-key based certificate distribution scheme allows mobile subscribers to obtain temporary certificates from the corresponding cellular network. Combining the proposed certificate distribution scheme with the EAP-TLS (Transport Layer Security) protocol, we present a new EAP authentication protocol called USIM-based EAP authentication protocol. The new EAP authentication protocol combining with USIM cards is an extension of the EAP-TLS protocol and also follows the EAP framework in the IEEE 802.1X standard. Compared to other EAP authentication protocols, the proposed protocol provides mutual authentication, strong identity protection and roaming capability between the cellular network and the WLAN networks.

Secure Protocol for Fast EAP Authentication in Wireless Networks

We study the problem of reducing the latency introduced by authentication and network access control processes required in heterogeneous wireless networks and based on the Extensible Authentication Protocol. We aim to reduce the time spent on providing access and smooth transition between different technologies which require to perform authentication in order to allow network access. We propose a secure protocol which reduces the number of roundtrips during authentication and verify its security properties with a formal tool.

Analysis of secure handover for IEEE 802.1x-based wireless ad hoc networks

The handover procedure in secure communication wireless networks is an extremely time-consuming phase, and it represents a critical issue in relation to the time constraints required by certain real-time traffic applications. In particular, in the case of the IEEE 802.1X model, most of the time required for a handover is used for packet exchanges that are required for authentication protocols, such as Extensible Authentication Protocol Transport Layer Security (EAP-TLS), that require an eight-way handshake. Designing secure re-authentication protocols to reduce the number of packets required during a handover is an open issue that is gaining interest with the advent of a pervasive model of networking that requires realtime traffic and mobility. This article presents the 802.1X model and evaluates its application to ad hoc networks based on IEEE 802.11 i or IEEE 802.1 be standards, focusing on the problems that must be evaluated when designing handover procedures, and suggesting guidelines for securing handover procedures. It also presents a novel protocol to perform secure handovers that is respectful of the previous analysis and that has been implemented in a mesh environment.

An Accelerated IEEE 802.11 Handoff Process Based on the Dynamic Cluster Chain Method

The latency of the IEEE 802.11 handoff process in wireless local area network (WLAN) is much higher than 50 ms. Since the bearable maximum delay is 50 ms in multimedia applications, e.g., voice over IP (VOIP), such large handoff gap may bring up excessive jitter. Therefore, many researches make much effort about how to fast handoff. In this paper, we propose an accelerated handoff mechanism in which three methods are involved: (1) dynamic cluster chain, (2) PMKSA caching, and (3) fast reassociation with the pairwise transient key security association (PTKSA) establishment. Access points (APs) are arranged as a cluster for each client station (STA). APs that are cluster members can cache PMKSA of STA in advance to reduce the extensible authentication protocol – transport Layer Security (EAP-TLS) authentication delay. The dynamic cluster chain, which is arranged by a dynamic cluster selection and transition method, is proposed to assure that STA stays within a cluster. Furthermore, the fast reassociation with the PTSA establishment process incorporates four-way handshake into the IEEE 802.11 reassociation process to further accelerate handoff process.

Selection of an EAP authentication method for a WLAN

IEEE 802.1X is a key part of IEEE802.11i. By employing Extensible Authentication Protocol (EAP) it supports a variety of upper layer authentication methods each with different benefits and drawbacks. Any one of these authentication methods can be the ideal choice for a specific networking environment. The fact that IEEE 802.11i leaves the selection of the most suitable authentication method to system implementers makes the authentication framework more flexible, but on the other hand leads to the question of how to select the authentication method that suits an organisation's requirements and specific networking environment. This paper gives an overview of EAP authentication methods and provides a table comparing their properties. It then identifies the crucial factors to be considered when employing EAP authentication methods in WLAN environments. The paper presents algorithms that guide the selection of an EAP-authentication method for a WLAN and demonstrates their application through three examples.

EAP methods for wireless networks

This paper presents an overview and analysis of Extensible Authentication Protocol (EAP) and its place in securing wireless LANs. A number of specific widely used EAP methods are examined and evaluated for their advantages and susceptibility to types of attack. Next we propose suitable EAP methods for wireless technologies beyond LANs, including RFID and WiMAX. After analyzing requirements for different wireless networks, we conclude that a new lightweight and secure EAP method is warranted for fixed mobile convergence interoperability.

A New Type of Network Security Protocol Using Hybrid Encryption in Virtual Private Networking

Today wireless communications is acting as a major role in networks. Through year-end 2006, the employee's ability to install unmanaged access points will result is more than 50% of enterprises exposing sensitive information through the wireless virtual private networks (VPN). It enables you to send the data between two computers across a shared or public network in a manner that emulates the properties of a private link. The basic requirements for VPN are User Authentication, Address Management, Data Compression, Data Encryption and Key Management. The private links are established in VPN using Point-to-Point Tunneling Protocol (PPTP) and Layer-Two-Tunneling Protocol (L2TP). These protocols are satisfies VPN requirements in five layers. In user authentication layer, multiple trusted authorities using Extensible Authentication Protocol (EAP) do the authentication process. In fourth layer the data encryption part using RC4 called Microsoft-Point-to-Point Encryption (MPPE) method. The aim of this paper, instead of multiple trusted authorities we focus single trusted authority using public key cryptography RSA in EAP and also we include AES-Rijndael stream cipher algorithm instead of RC4 for MPPE. We propose new type of hybrid encryption technique using AES-Rijndael for encryption and decryption and RSA used for key management.

How to Establish Secure Channels for Wireless Communications

The most fundamental security goals include authentication and confidentiality both of which can be achieved by an authenticated key establishment (so-called AKE) protocol where the involving parties authenticate each other and generate cryptographically-secure (but temporal) session keys for their subsequent secure channels. As AKE protocols for wireless security, the IEEE 802.1x standard committee employed the Extensible Authentication Protocol (EAP) methods: EAP-MD5, LEAP, EAP-SIM, EAP-AKA, EAP-TLS, EAP-TTLS and PEAP. In this paper, we first revisit the EAP methods considering the following practical situation: (1) a user, who communicates with many different servers, remembers only one password and has insecure mobile devices (e.g., mobile phones or PDAs) with very-restricted computing power and built- in memory capacity; (2) the counterpart servers have enormous computing power, but they are not perfectly secure against various attacks (e.g., virus or hacker); (3) neither PKI (Public Key Infrastructures) nor TRM (Tamper-Resistant Modules) is available. For the above situation, we introduce an RSA-based AKE (for short, RSA-AKE) protocol that satisfies both higher level of security and efficiency over their kinds.

GPRS∕UMTS-aided authentication protocol for wireless LANs

Wireless local area network (WLAN) and cellular network are two important technologies for providing wireless communications. For user authentication of WLAN, the IEEE 802.1X standard provides an authentication framework that is based on the Extensible Authentication Protocol (EAP). When a roaming user wants to access WLANs provided by different operators, the user must remember multiple identities and the corresponding authentication credentials. Obviously, such an exercise is not user friendly. This problem is caused by the fact that a visited WLAN does not have the authentication credential of a roaming user. Previous proposals have studied the authentication of inter-network roaming across different WLANs, or across a cellular network and a WLAN. As is known, cellular networks provide wider service areas, ‘always-on’ and ubiquitous connectivity. The integration of WLAN and cellular networks has a management advantage that it can unify the subscriber identity and the corresponding credential. In this paper, we first propose a practical certificate distribution scheme. The certificate distribution scheme allows roaming users of a cellular network to obtain temporary certificates from their home cellular network. Afterward adopting certificate-based authentication protocol of the IEEE 802.1X standard, roaming users may use temporary certificates to access WLANs. The proposed solution achieves easy subscriber management and pervasive access. As demonstrated, the proposed solution also provides mutual authentication and strong identity protection, in addition to withstanding the man-in-the-middle attack and the eavesdropping attack. A performance evaluation shows that the proposed protocol is well suited for roaming users with mobile devices.

Towards self-authenticable smart cards

Traditionally, the smart cards have been seen as security devices, but as soon as they could be integrated into distributed and networked environments their vulnerabilities could be attempted and countermeasures against new security threats in an open-access internet were required. In this work, our target could be represented by an end-to-end mutual authentication scenario where the smart card could authenticate by itself to a Network Access Server by means of link layer protocols and therefore in absence of IP connectivity. Some previous related models based on the Extensible Authentication Protocol are presented. However, in these works the smart card and terminal implement jointly the supplicant functionality (split supplicant). We consider the native EAP multiplexing model specified by the IETF to propose a new approach in order to avoid this split and to achieve an autonomous and highly independent smart card in the authentication scheme: a self-authenticable smart card.

Extensible authentication protocol (EAP) and IEEE 802.1x: tutorial and empirical experience

This article presents the technical details of the Extensible Authentication Protocol (EAP) and IEEE 802.1x by using WIRE1x, an open-source implementation of IEEE 802.1x client (supplicant) and various EAP-based authentication mechanisms. By using a real implementation, 802.1x and EAP should be easily understood.

Advanced SSL∕TLS-based authentication for secure WLAN-3G interworking

Motivated by the fact that the SSL protocol has proved its effectiveness in wired IP networks, recent research work has examined the potential use of this protocol in various wireless technologies. Although Wi-Fi networks present security deficiencies, they manage to penetrate the wireless market to a great degree due to their low cost, easy administration, great capacity, IP-oriented nature, etc. Considering Wi-Fi networking settings, administrated by different operators, as parts of a common core 3G infrastructure, the author propose the potential application of enhanced SSL-based authentication mechanisms in integrated emerging-3G and Wi-Fi networks. Existing problems related to authentication and key agreement (AKA) procedures and the extensible authentication protocol (EAP)-AKA, as they appear in the latest 3G and integrated 3G/Wi-Fi specifications, are discussed. It is proposed how EAP-TLS, combined with public key infrastructure (PKI) elements, can be used to overcome these inefficiencies in a hybrid WLAN-3G heterogeneous environment, in order to provide strong authentication and end-to-end security to the mobile user.

Authentication in wireless networks: state of the art and integration with smart card

Wirelesslan have spread very quickly over the past few years. Demand for wireless access tolans has raised due to new mobile computing devices, such as laptops and personal digital assistants, and a desire for seamless and permanent connections to networks. Nevertheless a lot of security issues remain and stop its deployment in corporations. One of the most important issues is the authentication of a terminal to an Access Point. We propose an interface to integrate the Extensible Authentication Protocol into smart cards and will show that smart cards could constitute the de-facto device for authentication in Wirelesslan as they are forgsm and will be forumts (Universal Mobile Telecommunication System).

A scheme for authentication and dynamic key exchange in wireless networks

Despite significant shortcomings in the initial security architecture, 802.11 wireless LANs have experienced explosive growth in recent years. Ongoing work in IEEE standards bodies is currently attempting to fix these shortcomings. One specific topic that has received extensive attention is how to enable these networks to authenticate users and to dynamically establish per-user per-session cryptographic keys. The IEEE 802.1x Port-Based Access Control standard, which formalizes a new EAP-over-LAN (EAPOL) protocol, has emerged as the preferred way to achieve this. The EAPOL protocol employs the extensible authentication protocol (EAP), standardized by the Internet Engineering Task Force, to allow the use of existing and new authentication methods and authentication, authorization, and accounting (AAA) infrastructure. In this paper we present a new EAP scheme — called shared key exchange (SKE) — suitable for use in 802.11 private or public access wireless LANs. The scheme relies on secure pre-shared secret keys in wireless LAN mobile nodes devices and AAA servers. When instantiated with relatively minor changes to RADIUS and EAP, the resulting protocol is provably secure and offers a full set of security features. A second, simplified protocol results from minimal modifications to existing RADIUS and EAP standards, but it provides a lower level of security. Both protocols efficiently support roaming scenarios wherein an end user roams across different networks and requires frequent re-authentication with low latency. The protocols can easily be extended to support migration to new AAA protocols such as DIAMETER.