02.11.2012 Views

Handover mechanisms in next generation heterogeneous wireless ...

Handover mechanisms in next generation heterogeneous wireless ...

Handover mechanisms in next generation heterogeneous wireless ...

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

CONCLUSIONS AND FUTURE RESEARCH WORK<br />

8.1.3 Proxy Based Authentication Localisation Scheme<br />

In Chapter 6, a Proxy Based Authentication Localisation (PBAL) scheme was proposed<br />

to provide fast authentication <strong>in</strong> a handover tak<strong>in</strong>g place between two networks without<br />

a trust relation. This is achieved by localis<strong>in</strong>g authentication <strong>in</strong> a handover at a proposed<br />

entity called Fast AAA Proxy (FAP). The FAP acts as a third-party entity for process<strong>in</strong>g<br />

AAA requests com<strong>in</strong>g from the networks associated with it. A trust association model<br />

based on pairwise keys shared between network entities was proposed. The proposed<br />

trust association model allows a large number of <strong>heterogeneous</strong> <strong>wireless</strong> networks to be<br />

<strong>in</strong>terconnected <strong>in</strong> a loosely coupled manner through a few FAPs.<br />

The thesis presented a fast authentication ticket <strong>generation</strong> and encryption mechanism.<br />

With this mechanism, a mobile’s home AAA server proactively produces the security<br />

credentials that can be used by the mobile user later for its fast authentication <strong>in</strong> a<br />

handover. The PBAL provides a mutual authentication mechanism, through which both<br />

a mobile user and its visited network’s associated FAP can perform identity verification<br />

mutually <strong>in</strong> a handover. This proposed authentication mechanism is further protected by<br />

a session wide Local Authentication Key (LAK) that is derived from the trust<br />

association between the mobile user and its home AAA server. To m<strong>in</strong>imise the risk of<br />

us<strong>in</strong>g a compromised session key, a session key renewal method was proposed <strong>in</strong> the<br />

PBAL. This session key renewal method allows both the mobile user and its visited<br />

network to <strong>in</strong>itialise session key renewal.<br />

The thesis adopted an analytical approach to evaluate the security of the proposed<br />

PBAL scheme. The analysis on mutual authentication showed that a mobile user is able<br />

to verify whether a FAP is an authorised agent represent<strong>in</strong>g its home AAA server. The<br />

mobile user authenticates to the FAP by show<strong>in</strong>g its knowledge of the LAK that can be<br />

computed us<strong>in</strong>g the correct preshared key applied between the mobile user and its home<br />

AAA server. The PBAL scheme demonstrated strong security aga<strong>in</strong>st the replay attacks<br />

<strong>in</strong> the form of an adversary impersonat<strong>in</strong>g a mobile user. Moreover, the PBAL provides<br />

sufficient protection aga<strong>in</strong>st the replay attacks, <strong>in</strong> which an adversary tries to fool a<br />

mobile user by impersonat<strong>in</strong>g an access network. This is done by us<strong>in</strong>g the LAK for the<br />

FAP verification, which is transitive and session related. Further security analysis was<br />

- 159 -

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!