Handover mechanisms in next generation heterogeneous wireless ...

SECURITY FOR HANDOVER ACROSS HETEROGENEOUS WIRELESS NETWORKS
but provides a mean for the communications between a supplicant and its authentication
server in a challenge-response manner. The specific authentication methods such as
EAP-TLS [50] can be easily introduced by extending the EAP framework. The message
flow of the EAP negotiations between the supplicant and the authentication server in the
three-party authentication model is described in Sec. 3.2.1. The transmission of EAP
messages on the client side (between the supplicant and the authenticator) can run
directly on link layer without requiring a network layer protocol. This section would
focus on the AAA protocols that carry EAP messages for authentication and key
exchanges on the AAA server side (between the authenticator and the AAA server).
Remote Access Dial-In User Service (RADIUS)
Remote Access Dial-In User Service (RADIUS) is a client/server protocol that enables a
remote Network Access Server (NAS, as a RADIUS client) to communicate with a
central RADIUS server to authenticate users and authorise their access to the requested
resources. A RADIUS client is responsible for passing user information in the form of
requests to the designated RADIUS server, and waits for a response from the server.
The RADIUS server is responsible for receiving user requests, authenticating users, and
then returning all configuration information necessary for the RADIUS client to deliver
service to the user. The RADIUS server can acts as a proxy client to other RADIUS
servers in a proxy chaining architecture that will be discussed later.
The type of RADIUS message is identified by the Code field in a RADIUS message
shown in Figure 3.8. According to the RADIUS specification (RFC 2865 [49]), eight
messages are defined. The Access-Request, Access-Accept, Access-Reject, and Access-
Challenge are of particular interest to this study. RADIUS carries information (e.g.
specific authentication, authorisation, and configuration details) in the form of attributes,
which are of variable length. New attribute values can be readily added to extend the
functionality of RADIUS server to interact with other entities.
Transactions between RADIUS client and server are protected through the use of a
shared secret. In addition, any user passwords sent over RADIUS has to be encrypted.
This is done by utilising the RSA Message Digest Algorithm 5 (MD5). As indicated in
Figure 3.8, an authenticator field of 16 octets is added to all RADIUS messages. This
- 48 -