A lightweight mutual authentication mechanism for network mobility in IEEE 802.16e wireless networks

Abstract

Many mobile network nodes (MNNs) in public transport move together as a large-scale mobile network. Therefore, RFC 3963 proposes a network layer solution called network mobility (NEMO) as the basic support protocol for network mobility management. NEMO is designed so that network mobility is transparent to nodes in the mobile network, thereby reducing the signaling overhead. However, NEMO does not specify how authentication, authorization and accounting (AAA) should be handled, and it inherits the drawbacks of long handoff latency from Mobile IPv6 (MIPv6). In this paper, we develop a lightweight mutual authentication mechanism (LMAM) with low computational overhead and achieve local authentication based on NEMO and the AAA model over IEEE 802.16e networks. Moreover, LMAM can resist various attacks. In addition, we propose an enhanced hierarchical Mobile IPv6 (E-HMIPv6) scheme to reduce intra-domain handoff latency. We then integrate LMAM into E-HMIPv6 without increasing the signaling overhead. Our analysis results show that the integrated scheme, called LE-HMIPv6 outperforms existing schemes in terms of authentication and handoff latency.

Introduction

The IEEE 802.16e standard (also called Mobile WiMAX) [1] describes a novel technique that supports high mobility, provides high bandwidth, and supplies large coverage area in the next generation broadband wireless networks. In such environments, people use mobile devices to access all kinds of services, such as Web-browsing, VoIP, video conferencing, and other multimedia applications, anytime-anywhere. In addition, users prefer that the system provides secure and seamless communications on the move. Therefore, developing an effective authentication mechanism and seamless handoff procedures have become important research issues.

In real life, using public methods of transportation such as ships, trains, buses and airplanes, many mobile network nodes (MNNs) move together as a large-scale mobile network. The Internet Engineering Task Force (IETF) proposed a network layer solution called network mobility (NEMO) [2], which is an extension of Mobile IPv6 (MIPv6) [3] and enables a mobile network moving among different foreign networks to maintain continuous connections. Although NEMO reduces the signaling overhead for mobility management, it inherits the drawbacks of long handoff latency from MIPv6. Moreover, NEMO does not specify how authentication, authorization and accounting (AAA) should be handled in mobile networks.

IETF proposed the AAA model [4], [5], [6] and diameter protocol [7] to solve the AAA problems when a network receives a request from a mobile node for roaming in a foreign network. Within this AAA model, there are four security associations (SAs) in the MIPv6 as shown in Fig. 1. The security association means two network entities share some secret information with each other. When a mobile router (MR) moves in a foreign domain, it has to provide some authentication information before it can access the resources of that domain. However, in traditional authentication mechanisms, one of the technical challenges is that a roaming MR and a local AAA (LAAA) server cannot pre-share any secret information because they lack a direct security association as shown in Fig. 1. As the LAAA does not have sufficient information to verify the authentication information of the MR, it must send the information back to the home AAA (HAAA) server of the MR and wait for a reply. This restriction results in authentication inefficiency since the authentication information needs to be passed between the home and the foreign networks. Moreover, the MR needs to be authenticated frequently if it often roams in different domains. The problem becomes more serious as the distance between the foreign and home networks increases.

In this paper, we develop a lightweight mutual authentication mechanism (LMAM) with low computational overhead and achieving local authentication based on NEMO and the AAA model over IEEE 802.16e networks. In addition, an efficient authentication scheme should take account of two factors: the computation cost of cryptography and the authentication latency. Therefore, our proposed LMAM has the following characteristics. (1) The computation cost is low because LMAM is a lightweight security mechanism that only uses symmetric cryptography and a hash function [8] to resolve the high computation problem of the public key infrastructure (PKI). (2) LMAM provides local authentication (i.e., authentication can be finished locally), which reduces the authentication latency and decreases the workload of the HAAA server without assuming that the MR and the LAAA server pre-share a session key. (3) LMAM fulfills the following security requirements: replay attack resistance, stolen-verified attack resistance, mutual authentication to prevent server spoofing attacks, and session key generation. Moreover, we propose an enhanced hierarchical Mobile IPv6 (E-HMIPv6) scheme to reduce intra-domain handoff latency. We then integrate LMAM into E-HMIPv6, called LE-HMIPv6 without increasing the signal overhead. The performance results show that the integrated scheme outperforms existing schemes in terms of authentication and handoff latency.

The remainder of this paper is organized as follows. In Section 2, we review related work in respect of security and handoff. Section 3 describes the operations of the proposed LMAM, E-HMIPv6, and LE-HMIPv6 mechanisms in detail. In Section 4, we present a security analysis of LMAM, and we analyze the performance of the proposed mechanisms in Section 5. Then, in Section 6, we summarize our conclusions and future work.