Handover mechanisms in next generation heterogeneous wireless ...

SECURITY FOR HANDOVER ACROSS HETEROGENEOUS WIRELESS NETWORKS
authenticator PAE exchanges 802.1X messages with the supplicant PAE through the
uncontrolled port before the supplicant is authenticated. The exchange of data traffic is
allowed through the controlled port after the supplicant is authenticated successfully.
The 802.1X utilises Extensible Authentication Protocol (EAP) [18] to provide a variety
of authentication mechanisms. The EAP does not have an addressing mechanism and
has its messages encapsulated over EAP Over LAN (EAPOL) protocol between the
supplicant and the authenticator.
The 802.11i defines two classes of security algorithms for IEEE 802.11 networks:
Robust Security Network Association (RSNA) and pre-RSNA. A Robust Security
Network (RSN) is a security network that allows the creation of robust security network
associations, RSNAs, between all stations [48]. The RSNA security comprises two
security algorithms: IEEE 802.11 entity authentication and WEP. The 802.11i standard
suggests that pre-RSNA methods that have already been included in IEEE 802.11 [46]
will be implemented to aid migration to RSNA methods. The key management defined
for RSNA authentication will be presented here for further elaboration on the enhanced
authentication mechanism in 802.11 WLAN.
When the IEEE 802.1X authentication is used, the supplicant PAE initiates the
authentication to the authenticator by sending an EAPOL-Start message to the
authenticator. As shown in Figure 3.3, the authenticator replies with an EAP-
Request/Identity to obtain the user’s identity. The user then sends back an EAP-
Response/Identity containing its identity in response to the received EAP identity
request. Upon receiving the EAP Response, the authentication PAE needs to deliver the
EAP response message to the authentication server. The communications for
authentication between the authenticator and the authentication server can be achieved
using the AAA protocols like Remote Access Dial In User Service (RADIUS, RFC
2865 [49]). The authenticator encapsulates the EAP-Response/Identity message in a
RADIUS Access-Request message, and sends it to the RADIUS authentication server.
Multi-round authentication message exchanges will be needed to verify the identities of
both EAP entities (the supplicant and the authentication server as shown in Figure 3.3).
The verification can be carried out by means of Extensible Authentication Protocol-
Transport Level Security (EAP-TLS, RFC 2716 [50]) protocol, which is outside the
- 41 -