Protocol For Carrying Authentication For Network Access Research Articles

The Universal Fog Proxy: A Third-party Authentication Solution for Federated Fog Systems with Multiple Protocols

Fog computing is suitable for latency constrained applications useful to end users and IoT devices in smart cities, factories, and homes. A federation among fogs is beneficial for subscribers and providers in terms of enhanced capability, capacity, coverage, and services. To realize such a federation, a third-party authentication mechanism among fog providers is required, so that a subscriber of a fog can access the services provided by the other fogs without having to create new accounts. In this article, we propose a transparent and standard-compliant universal fog proxy that provides third-party authentication among OpenID Connect (OIDC), 802.1x, and Protocol for Carrying Authentication for Network Access (PANA) without requiring a new protocol. The proxy consists of virtual counterparts of the entities involved in these protocols so that it provides transparency. For example, when a fog using OIDC receives an authentication request, the proxy relays and behaves as a virtual Identity Provider (vIdP) for the fog using OIDC and a virtual supplicant for the fog using 802.1x. We applied our solution to nine scenarios across OIDC, 802.1x, and PANA. Experimental results show that the proxy takes 4–52 percent of the total authentication time of 0.128-3.504s for nine scenarios, with a larger percentage in scenarios involving OIDC due to multiple re-directions among virtual components. The scenarios involving 802.1x take a considerably lon-ger time, though a low percentage (4–12 percent) by the proxy, as the spanning tree protocol in an 802.1x switch takes about one second to converge when adding a new device to the network.

Multihop Bootstrapping With EAP Through CoAP Intermediaries for IoT

In the renowned Internet of Things (IoT) networks, it is expected a vast number of devices with IP connectivity and constrained capabilities. Due to reduced resources they are the target of different type of attacks and providing security has become a basic pillar for the success and evolution of IoT. Among the specific key security aspects are the authentication, access control and key distribution for data protection. In particular, all these aspects are included in the process of bootstrapping , which allows a Smart Object to join a network domain in a secure fashion. This process, which indeed involves authentication, authorization, and key distribution, typically requires communication between the smart object and an entity, the Controller , in charge of steering the bootstrapping process within the network’s domain. However, direct communication between both might be impeded, e.g., when the entity is unreachable by radio, or the smart object does not have a routable IP address until it is successfully authenticated and authorized to join the network. A common solution is to use an intermediate entity (the Intermediary ) to aid in this task. For example, the ZigBee IP standard defines a relay for the protocol for carrying authentication for network access (PANA). Moreover, the IETF is exploring the use of an intermediary to help this process. In this paper, we analyze, explore, and design an intermediary based on constrained application protocol (CoAP). We pay attention to the authentication with the extensible authentication protocol (EAP) and CoAP, which has resulted in a more constrained alternative to PANA for EAP-based bootstrapping in IoT. Nevertheless, our design of the CoAP-based intermediary is so general that it is independent of the authentication protocol in use. In particular, we have analyzed as intermediary the usage of a CoAP proxy , as defined in the CoAP standard; alternatively we have introduced the concept of the CoAP relay and CoAP stateless proxy . We evaluate the performance of each solution and we compare between them and with PANA relay.

PANATIKI: A Network Access Control Implementation Based on PANA for IoT Devices

Internet of Things (IoT) networks are the pillar of recent novel scenarios, such as smart cities or e-healthcare applications. Among other challenges, these networks cover the deployment and interaction of small devices with constrained capabilities and Internet protocol (IP)-based networking connectivity. These constrained devices usually require connection to the Internet to exchange information (e.g., management or sensing data) or access network services. However, only authenticated and authorized devices can, in general, establish this connection. The so-called authentication, authorization and accounting (AAA) services are in charge of performing these tasks on the Internet. Thus, it is necessary to deploy protocols that allow constrained devices to verify their credentials against AAA infrastructures. The Protocol for Carrying Authentication for Network Access (PANA) has been standardized by the Internet engineering task force (IETF) to carry the Extensible Authentication Protocol (EAP), which provides flexible authentication upon the presence of AAA. To the best of our knowledge, this paper is the first deep study of the feasibility of EAP/PANA for network access control in constrained devices. We provide light-weight versions and implementations of these protocols to fit them into constrained devices. These versions have been designed to reduce the impact in standard specifications. The goal of this work is two-fold: (1) to demonstrate the feasibility of EAP/PANA in IoT devices; (2) to provide the scientific community with the first light-weight interoperable implementation of EAP/PANA for constrained devices in the Contiki operating system (Contiki OS), called PANATIKI. The paper also shows a testbed, simulations and experimental results obtained from real and simulated constrained devices.

Out-of-band federated authentication for Kerberos based on PANA

Nowadays, network operators and educational and research communities are extending the access to their Internet application services to external end users by deploying, with other domains, the so-called identity federations. In these federations, end users use the identity and authentication credentials registered in their home organizations for accessing resources managed by a remote service provider. However, current identity federation solutions focus mainly on assisting network access and web services, while a significant number of services are left aside (e.g., SSH, FTP, Jabber, etc.). Taking advantage of the widespread adoption of Kerberos by current application services, this paper presents a solution to provide federated access to any kind of application service by using existing Authentication, Authorization and Accounting (AAA) infrastructures. The solution bootstraps a security association, in the service provider which enables the acquisition of a Kerberos credential to access the service. To link the end user authentication with the AAA infrastructure and the bootstrapping of the security association the solution uses the so-called Protocol for Carrying Authentication for Network Access (PANA).

Network access security for the internet: protocol for carrying authentication for network access

Network access authentication is a key procedure for network operators to control user access to the network service. The IETFs recently finished its major work in this area by standardizing an IP-based protocol named Protocol for Carrying Authentication for Network Access (PANA). We provide a comprehensive survey of PANA based on developed IETF standards, and describe its applicability to both existing and emerging network environments.