HIP DEX for Fast Initial Authentication in 802.11 Konstantinos Georgantas, HIIT Page 1 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 HIP DEX for Fast Initial Authentication in 802.11 Date: 2011-05-10 Authors: Name Company Address Phone email Konstantinos Georgantas Helsinki Institute for Information Technology 0030-6974343988 Konstantinos.Georgantas@hiit.fi Robert Moskowitz Verizon Business 15210 Sutherland, Oak Park, MI 48237, USA +1-248-219-2059 rgm@labs.htt-consult.com Slide 1 Konstantinos Georgantas, HIIT Page 1 Konstantinos Georgantas, HIIT
Abstract Konstantinos Georgantas, HIIT Page 2 doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 Abstract This document presents the use of a HIP Diet EXchange (DEX) based architecture which intends to provide the necessary IP layer elevated security mechanisms in order to face the challenge of fast authentication in WLANs. HIP introduces a radically new way of authenticating hosts in WLANs in only two message exchanges and therefore saves time during authentication Slide 2 Konstantinos Georgantas, HIIT Page 2 Konstantinos Georgantas, HIIT
Agenda Konstantinos Georgantas, HIIT Page 3 doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 Agenda Problem statement Solution overview Network architecture HIP DEX adjustments Protocol operation Open work items Conclusions Slide 3 Konstantinos Georgantas, HIIT Page 3 Konstantinos Georgantas, HIIT
Problem Statement Konstantinos Georgantas, HIIT Page 4 doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 Problem Statement Why Fast Initial Authentication? Moving users with high velocity between APs Big amount of users entering an AP Smaller and smaller cell areas Ultimate goal: Can we go with a single roundtrip? Slide 4 Konstantinos Georgantas, HIIT Page 4 Konstantinos Georgantas, HIIT
Solution Overview (1/3) Konstantinos Georgantas, HIIT Page 5 doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 Solution Overview (1/3) Maybe not a single roundtrip but what about 2 roundtrips? “Lightweight Authentication and Key Management on 802.11 Wireless Networks” by Konstantinos Georgantas and Andrei Gurtov submitted in IEEE GLOBECOM 2011 Introduce a new network hierarchy Move the authenticator – HIP responder one level above Authentication only when ESS transition occurs Let the APs act as relays Introduce port based Net Access Control allowing HIP only traffic until the Initiator is authenticated Slide 5 Konstantinos Georgantas, HIIT Page 5 Konstantinos Georgantas, HIIT
Solution Overview (2/3) Konstantinos Georgantas, HIIT Page 6 doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 Solution Overview (2/3) Let HIP datagrams run over 802.11 Authentication frames HIP UPDATE can act as a rekeying mechanism EAP can also run on HIP! Slide 6 Konstantinos Georgantas, HIIT Page 6 Konstantinos Georgantas, HIIT
Solution Overview (3/3) Konstantinos Georgantas, HIIT Page 7 doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 Solution Overview (3/3) Proposed operation Slide 7 Konstantinos Georgantas, HIIT Page 7 Konstantinos Georgantas, HIIT
Reference Papers Konstantinos Georgantas, HIIT Page 8 doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 Reference Papers Some papers to review D. Kuptsov, A. Khurri, A. Gurtov, Distributed authentication architecture in Wireless LANs, in Proc. of the 10th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM'09), June 2009. http://www.cs.helsinki.fi/u/gurtov/papers/wowmom09.pdf J. Korhonen, A. Mäkelä, T. Rinta-aho, HIP Based Network Access Protocol in Operator Network Deployments http://rinta-aho.com/papers/M2NM_napi.pdf Slide 8 Konstantinos Georgantas, HIIT Page 8 Konstantinos Georgantas, HIIT
Open Work Items Konstantinos Georgantas, HIIT Page 9 doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 Open Work Items STA validation of AP Include a CERT parameter in R1 that contains an X.509 cert for the AP Assumption is the STA can validate the cert without any 'upstream' assistance, or delay validation until IP connectivity is provided Timing concerns for AUTHENTICATION RESPONSE 802.11 does not specify a response time window, but does WiFi certification? If so do we need NULL keepalives or loosening of timings when AUTHENTICATION used for KMP? Slide 9 Konstantinos Georgantas, HIIT Page 9 Konstantinos Georgantas, HIIT
Conclusions Thank you! Konstantinos Georgantas, HIIT Page 1010 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 Conclusions Seamless intra-domain handovers (BSS transitions) Only 2 roundtrips (instead of 11) for inter-domain handovers (ESS transitions) But there are still some security considerations under review Thank you! Slide 10 Konstantinos Georgantas, HIIT Page 10 Konstantinos Georgantas, HIIT