Handover mechanisms in next generation heterogeneous wireless ...

PROXY BASED AUTHENTICATION LOCALISATION SCHEME FOR HANDOVER
verification can be performed locally using the pre-distributed credentials. This
neighbour graph based proactive approach can be applied to handover within the same
administrative domain [69]. Instead of pushing the pre-authentication credentials
straight to APs, Hong et al. presented a hierarchical key management scheme in [71]. In
the hierarchical key management scheme, a Local Master Key (LMK) is generated by
the home AAA server, and pre-distributed to a local authentication server for managing
pre-authentication for intra-domain handover. However, it is still required that the home
AAA server plays a role in providing the necessary LMK to the new local
authentication server during an inter-domain handover.
Apart from the reactive and proactive authentication solutions, other approaches for fast
authentication have been studied in the literature. In an attempt to localise
authentication in the roaming across WLANs, Long et al. utilised the public key
certificate structure to establish trust relationships between each pair of operators [99].
The public key certificate based authentication needs every network to store (n-1) public
certificates of its own, and (n-1) public keys of other networks as discussed in [99].
Consequently, it may not be scalable when a large number of networks get involved.
The Seamless Authentication Protocol (SAP) [100] is another operator-shared-key
based scheme for facilitating fast authentication. It supports the sharing of a SAP master
key among different AAA servers. Temporary security keys are derived from this
master key for local identity verification at AP level. The SAP’s scalability can be
partially improved by utilising the group-based key update [100]. However, the SAP
approach implicitly requires a trust relation between two domains in an inter-domain
handover, which may not always be the case.
6.3 Proxy-Based Authentication Localisation
As discussed in Sec. 6.2, current fast authentication solutions for handover are based on
the same assumption that there has to be a secure channel between two points of
attachment involved in a handover for transferring security context. They are applicable
for handovers within the same domain or two independent domains of the same operator.
The handover between two separated domains belonging to different operators can be
supported when a trust relationship exists between them.
- 116 -