Internet Key Exchange Version Research Articles

5G wireless P2MP backhaul security protocol: an adaptive approach

5G has introduced various emerging demands for new services and technologies that raised the bar for quality of service, latency, handovers, and data rates. Such diverse and perplexing network requirements bring numerous issues, among which security stands in the first row. The backhaul, which can be implemented as a wired or wireless solution, serves as a bridge between the radio access and core networks assuring connectivity to end users. The recent trends in backhaul usage rely on wireless technologies implemented using point-to-point (PTP) or point-to-multipoint (P2MP) configurations. Unfortunately, due to the nature of the transmission medium, the wireless backhaul is vulnerable and exposed to more various security threats and attacks than the wired one. In order to protect the backhaul, there have been several researches, whose authentication and key exchange scheme mainly depends on the existing security standards such as transport layer security (TLS), Internet Key Exchange version 1 (IKEv1), IKEv2, Host Identity Protocol (HIP), and Authentication and Key Agreement (AKA). However, such security standards cannot completely fulfil the security requirements including security policy update, key update, and balancing between security and efficiency, which are necessary for the emerging 5G networks. This is basically the motive behind why we study and propose a new security protocol for the backhaul link of wireless access network based on P2MP model. The proposed protocol is designed to be 5G-aware, and provides mutual authentication, perfect forward secrecy, confidentiality, integrity, secure key exchange, security policy update, key update, and balancing trade-off between efficiency and security while preventing resource exhaustion attacks. The protocol’s correctness is formally verified by the well-known formal security analysis tools: BAN-logic and Scyther. Moreover, the derived lemmas prove that the security requirements are satisfied. Finally, from a comparison analysis, it is shown that the proposed protocol is better than other standard protocols.

TinyIKE: Lightweight IKEv2 for Internet of Things

There is unanimous consensus that cyber security in the Internet of Things (IoT) is necessary. In cyber security, key establishment is one of the toughest problems. It is even more challenging in resource-constrained but Internet-connected IoT devices that use low-power wireless communication. A number of IoT communication protocols define cryptographic mechanisms for confidentiality and integrity services but do not specify key management. For example, IEEE 802.15.4, RPL, and object security all rely on external key management protocols. Due to the lack of automatic key management support, IoT devices either end up using preshared keys or no security at all. In this paper, we overcome these challenges and present TinyIKE, a lightweight adaptation of Internet Key Exchange version 2 (IKEv2) for the IoT. Using TinyIKE, we solve the key establishment problem for multiple IoT protocols using a single IKEv2-based solution. We implement TinyIKE for resource-constrained IoT devices that run the Contiki OS. The TinyIKE implementation supports full certificate-based IKEv2 that uses elliptic curve cryptography. In order to ensure the feasibility of TinyIKE in the IoT, we perform an extensive evaluation of TinyIKE using a setup consisting of real IoT hardware.

Novel secure VPN architectures for LTE backhaul networks

In this paper, we propose two secure virtual private network architectures for the long-term evolution backhaul network. They are layer 3 Internet protocol (IP) security virtual private network architectures based on Internet key exchange version 2 mobility and multihoming protocol and host identity protocol. Both architectures satisfy a complete set of 3GPP backhaul security requirements such as authentication, authorization, payload encryption, privacy protection, and IP-based attack prevention. The security analysis and simulation results verify that the proposed architectures are capable enough to protect long-term evolution backhaul traffic against various IP-based attacks. Copyright © 2016 John Wiley & Sons, Ltd.

Securing Vehicular IPv6 Communications

A common practice is applying security after a network has been designed or developed. We have the opportunity of not committing this error in vehicular networks. Apart from particular works in the literature, ETSI TC ITS has defined general security services for (vehicular) cooperative systems. However, existent efforts do not pay the needed attention to the integration of IPv6 yet. The potential of IPv6 in the field is being described within ISO TC 204, above all, but further work is needed for a proper integration of security. This work follows this direction, and a reference vehicular communication architecture considering ETSI/ISO regulations, uses Internet Protocol security (IPsec) and Internet Key Exchange version 2 (IKEv2) to secure IPv6 Network Mobility (NEMO). A key advance is also the implementation and experimental evaluation of the proposal in a challenging vertical handover scenario between 3G and 802.11p. The performance of the secured NEMO channel is widely analyzed in terms of the movement speed, bandwidth, traffic type or signal quality, and it is concluded that the addition of IPv6 security only implies a slight reduction in the overall performance, with the great advantage of providing confidentiality, integrity and authenticity to the communication path.

Collaborative Key Exchange System Based on Chinese Remainder Theorem in Heterogeneous Wireless Sensor Networks

IPv6 over Low Power Wireless Personal Area Networks (6LoWPANs), in the next generation of wireless sensor networks, represent an emerging field which can be integrated with Internet technology. Security is one of the most important issues in 6LoWPANs given the vulnerability to security threats from Internet and the inherent constraints such as bandwidth, processing power, memory, and energy. Despite limited resources, data security for nodes adds an additional heavy cost by using various security schemes. Moreover, there is no standard approach to provide the end-to-end security in 6LoWPANs. In this work, we first axed our research to propose a new end-to-end security scheme for IP enabled sensor networks to optimize battery energy consumption and then we adapted the Internet Key Exchange version 2 (IKEv2) to wireless sensor networks while taking into consideration the scarce resources. Hence a novel Cooperative Key Exchange System (CKES) has been proposed in this paper based on Chinese Remainder Theorem (CRT) which has also been implemented in NS2 to analyze energy consumption compared to IKEv2.

Secure collaborative system in heterogenous wireless sensor networks

The IPv6 over Low power Wireless Personal Area Networks (6LoWPANs) have turned out to be one of the most emerging field in Wireless Sensor Networks (WSNs) which can be integrated with Internet technology. 6LoWPAN network consists of heterogeneous wireless sensors which have high resource-constraints such as bandwidth, processing power, memory, energy, etc. The resource-constraints put forth many challenges to apply the available standard security protocols such as Transport Layer Security (TLS), Internet Protocol Security (IPSec), Internet Key Exchange version 2 (IKEv2), etc., for the interconnection of Heterogeneous Wireless Sensor Networks (HWSNs) with Internet. To overcome these situations, the researchers aimed to reinforce and adapt the end-to-end security between Internet and the IP enabled sensor networks. The above mentioned security protocols are not modified at the Internet end point in HWSNs. Hence we are proposing a novel Cooperative Key Exchange System (CKES) by using the concept of Chinese Remainder Theorem (CRT). We have used NS2 simulator to implement the proposed concept and also compared with IKEv2. All Rights Reserved © 2015 Universidad Nacional Autonoma de Mexico, Centro de Ciencias Aplicadas y Desarrollo Tecnologico. This is an open access item distributed under the Creative Commons CC License BY-NC-ND 4.0.

Automated Analysis of Internet Key Exchange Protocol v2 for Denial of Service Attacks

The Denial of service (DoS) and Distributed Denial of Service (DDoS) attacks are aimed at maliciously consuming the available resources in computing systems to prevent genuine users from legitimately accessing them. These attacks can easily interrupt or disable targeted systems, so it is important for the system to detect and filter bogus connection requests as early as possible. Many common protocols TCP, HIP, SSL, etc., are vulnerable to DoS attacks. Until now, there has been no fit for all, generic solution to resist a DoS/DDoS attacks presented. An attractive alternative therefore is to investigate the approaches by which one can at least reduce the impact of the DoS/DDoS attacks. Our research work presented here focuses on the same. We develop a formal model of Internet Key Exchange version 2 (IKEv2) protocol using formal specification language of Colored Petri Nets (CPNs) to analyze the protocol for DoS attacks. IKEv2 is a member of the IPSec protocol suite and establishes a security association that includes secret information between source and destination. IPSec provides security services to applications viz. VPN, remote login, email, file transfer etc. Till date no automatic formal analysis of IKEv2 protocol is attempted for DoS attacks, hence we choose IKEv2 protocol to illustrate automatic analysis for DoS attacks. We use simulation approach of CPNs to analyze the protocol for DoS attacks. We analyze the processing cost and memory cost to carry out DoS attacks in IKEv2. In addition, we measure the strength of the protocol against DoS attacks using different experiments in CPNs.

Suitability analysis of existing and new authentication methods for future 3GPP Evolved Packet Core

The fourth generation of 3GPP networks is evolving toward the realization of true global mobile broadband services. This stimulates the appearance of new applications, such as remote sensing and controlling services running on resource-constrained wireless devices, but also comes along with new challenges regarding performance and cost of the whole system, involving the requirement for lightweight security services.This paper analyzes the suitability of a recently developed protocol, i.e., the Host Identity Protocol using Diet Exchange extended with Authentication and Key Agreement, as a new option providing lightweight unified network access service in 3GPP Evolved Packet Core and replacing Internet Key Exchange version 2 with EAP-AKA. The proposed technology is compared with five other Layer-3 authentication methods under security, performance, deployment and functionality related criteria and trade-offs of the alternatives are analyzed. The results show that it is worth using this recent authentication method in scenarios where low performance overhead and support of extra functionalities such as multi-access capabilities are important. Consequently, the concept of a new secure data tunneling option is proposed for these scenarios for distributed Evolved Packet Core.

IKEv2 authentication exchange model and performance analysis in mobile IPv6 networks

Internet Key Exchange version 2 (IKEv2) is taking the responsibility for distribution and management of reliable authentication key. IKEv2 can secure fast hand off, confidentiality of data, safe transmission, and multihoming to transmission node. In this paper, we designed and constructed the network based on real mobile node and experimented the modeling of IKEv2 protocol through the simulation. We analyzed the resetting of authentication key and re-exchange problem. And we experimented the effect that key exchange is affected by a limited bandwidth based on data analysis. To overcome delay time, we proposed multi-interface of node and analyzed performance and latency for authentication setting and exchange process. The simulation results show that re-authentication of key is impossible to reset because of limited bandwidth of network. Also, the use of proposed multi-interface can minimize key exchange latency that happened by hand off for IPSec transmission.

Mobility and security in a real VANET deployed in a heterogeneous networks

AbstractThis paper describes the experience and findings of deploying a vehicular scenario based on a heterogeneous network. WiMAX and Wi‐Fi have been chosen as access technologies because of their wide presence in the market and their different coverage range. Our approach has been developed, taking into account crucial aspects regarding mobility and security. These two aspects have been provided by Network Mobility and Internet Key Exchange version 2 protocols, respectively. In addition, a study about how to interoperate them has been performed, describing the benefits and drawbacks of every existing approach. Regarding handover latency, some improvements have been identified in order to reduce it to the minimum. Fast authentication methods, pre‐authentication method, and “multiple care‐of addresses” mechanism are examples of these improvements. Copyright © 2012 John Wiley & Sons, Ltd.

ECC Based IKE Protocol Design for Internet Applications

The Internet Key Exchange (IKE) protocol is most widely used as a secure key exchange protocol to exchange key materials and negotiate security associations between two security gateways for any secure communications over Internet. However, the original IKE is too flexible, complex and weak to denial-of-service (DoS) attack; several enhanced IKE version have been proposed to replace the original one. In this paper, an elliptic curve cryptography (ECC) based and certificate less IKE protocol is proposed. It eliminates the use of certificates for authentication, replaces the RSA based Diffie-Hellman (DH) key exchange by Elliptic Curve Diffie-Hellman (ECDH) key exchange, and instead of cookies, hash value of initiator's public key, identity and IP address is used to prevent DoS attack. One advantage of the proposed scheme is that it provides same level of security as RSA with less key size, as well as it generates an ECC based common secret key, used for symmetric encryption, which requires less processing time, less computation cost and less storage space than the time required in the public key encryption-based techniques.

A network-assisted mobile VPN for securing users data in UMTS

This paper proposes a network-assisted mobile Virtual Private Network (mVPN) security scheme that provides secure remote access to corporate resources over the Universal Mobile Telecommunication System (UMTS). The proposed scheme, which is based on IPsec, distributes the required security functionality for deploying a VPN between the involved user’s device and the mobile network limiting the configuration, computation and communication overheads associated with the user and its device. The network-assisted mVPN addresses the security weaknesses of the UMTS technology in protecting users’ data and satisfies the security requirements of the mobile users. It can be integrated into the UMTS network infrastructure requiring only some limited enhancements to the existing mobile network architecture, and without disrupting the network operation. For the initialization of a network-assisted mVPN and the related key agreement an extension of Internet Key Exchange version 2 (IKEv2) is proposed. The proposed network-assisted mVPN can operate seamlessly and provide security services continuously while the mobile user moves and roams as it binds the UMTS mobility management with the VPN deployment. The deployment cost of the proposed scheme is evaluated analytically and via simulations and is compared to that of the end-to-end (e2e) VPN scheme that protects the data exchanged between the mobile user and the remote server, and a scheme that does not include any additional security mechanism. The proposed scheme increases the cumulative VPN deployment cost compared to the e2e scheme, but on the other hand it limits considerably the VPN deployment cost of the involved MS, which is important due to it resource limitation. Moreover, it does not considerably affect the capacity of the UMTS network. Finally, the deployed network-assisted mVPN hardly has an impact on the total delay of the transmitted user’s packets.