1. HIP DEX for Fast Initial Authentication in 802.11
Konstantinos Georgantas, HIIT
Page 1
May 2011
doc.: IEEE /xxxxr0
May 2011
doc.: IEEE /xxxxr0
May 2011
HIP DEX for Fast Initial Authentication in
Date:
Authors:
Name
Company
Address
Phone
Konstantinos Georgantas
Helsinki Institute for Information Technology
Robert Moskowitz
Verizon Business
15210 Sutherland, Oak Park, MI 48237, USA
Slide 1
Konstantinos Georgantas, HIIT
Page 1
Konstantinos Georgantas, HIIT

2. Abstract Konstantinos Georgantas, HIIT Page 2
doc.: IEEE /xxxxr0
May 2011
May 2011
doc.: IEEE /xxxxr0
May 2011
Abstract
This document presents the use of a HIP Diet EXchange (DEX)
based architecture which intends to provide the necessary IP layer
elevated security mechanisms in order to face the challenge of fast
authentication in WLANs. HIP introduces a radically new way of
authenticating hosts in WLANs in only two message exchanges and
therefore saves time during authentication
Slide 2
Konstantinos Georgantas, HIIT
Page 2
Konstantinos Georgantas, HIIT

3. Agenda Konstantinos Georgantas, HIIT Page 3
doc.: IEEE /xxxxr0
May 2011
May 2011
doc.: IEEE /xxxxr0
May 2011
Agenda
Problem statement
Solution overview
Network architecture
HIP DEX adjustments
Protocol operation
Open work items
Conclusions
Slide 3
Konstantinos Georgantas, HIIT
Page 3
Konstantinos Georgantas, HIIT

4. Problem Statement Konstantinos Georgantas, HIIT Page 4
doc.: IEEE /xxxxr0
May 2011
May 2011
doc.: IEEE /xxxxr0
May 2011
Problem Statement
Why Fast Initial Authentication?
Moving users with high velocity between APs
Big amount of users entering an AP
Smaller and smaller cell areas
Ultimate goal:
Can we go with a single roundtrip?
Slide 4
Konstantinos Georgantas, HIIT
Page 4
Konstantinos Georgantas, HIIT

5. Solution Overview (1/3) Konstantinos Georgantas, HIIT Page 5
doc.: IEEE /xxxxr0
May 2011
May 2011
doc.: IEEE /xxxxr0
May 2011
Solution Overview (1/3)
Maybe not a single roundtrip but what about 2 roundtrips?
“Lightweight Authentication and Key Management on Wireless Networks” by Konstantinos Georgantas and Andrei Gurtov submitted in IEEE GLOBECOM 2011
Introduce a new network hierarchy
Move the authenticator – HIP responder one level above
Authentication only when ESS transition occurs
Let the APs act as relays
Introduce port based Net Access Control allowing HIP only traffic until the Initiator is authenticated
Slide 5
Konstantinos Georgantas, HIIT
Page 5
Konstantinos Georgantas, HIIT

6. Solution Overview (2/3) Konstantinos Georgantas, HIIT Page 6
doc.: IEEE /xxxxr0
May 2011
May 2011
doc.: IEEE /xxxxr0
May 2011
Solution Overview (2/3)
Let HIP datagrams run over Authentication frames
HIP UPDATE can act as a rekeying mechanism
EAP can also run on HIP!
Slide 6
Konstantinos Georgantas, HIIT
Page 6
Konstantinos Georgantas, HIIT

7. Solution Overview (3/3) Konstantinos Georgantas, HIIT Page 7
doc.: IEEE /xxxxr0
May 2011
May 2011
doc.: IEEE /xxxxr0
May 2011
Solution Overview (3/3)
Proposed operation
Slide 7
Konstantinos Georgantas, HIIT
Page 7
Konstantinos Georgantas, HIIT

8. Reference Papers Konstantinos Georgantas, HIIT Page 8
doc.: IEEE /xxxxr0
May 2011
May 2011
doc.: IEEE /xxxxr0
May 2011
Reference Papers
Some papers to review
D. Kuptsov, A. Khurri, A. Gurtov, Distributed authentication architecture in Wireless LANs, in Proc. of the 10th IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM'09), June 2009.
J. Korhonen, A. Mäkelä, T. Rinta-aho, HIP Based Network Access Protocol in Operator Network Deployments
Slide 8
Konstantinos Georgantas, HIIT
Page 8
Konstantinos Georgantas, HIIT

9. Open Work Items Konstantinos Georgantas, HIIT Page 9
doc.: IEEE /xxxxr0
May 2011
May 2011
doc.: IEEE /xxxxr0
May 2011
Open Work Items
STA validation of AP
Include a CERT parameter in R1 that contains an X.509 cert for the AP
Assumption is the STA can validate the cert without any 'upstream' assistance, or delay validation until IP connectivity is provided
Timing concerns for AUTHENTICATION RESPONSE
does not specify a response time window, but does WiFi certification?
If so do we need NULL keepalives or loosening of timings when AUTHENTICATION used for KMP?
Slide 9
Konstantinos Georgantas, HIIT
Page 9
Konstantinos Georgantas, HIIT

10. Conclusions Thank you! Konstantinos Georgantas, HIIT Page 1010
May 2011
doc.: IEEE /xxxxr0
May 2011
doc.: IEEE /xxxxr0
May 2011
Conclusions
Seamless intra-domain handovers (BSS transitions)
Only 2 roundtrips (instead of 11) for inter-domain handovers (ESS transitions)
But there are still some security considerations under review
Thank you!
Slide 10
Konstantinos Georgantas, HIIT
Page 10
Konstantinos Georgantas, HIIT