1 / 18

Security architecture in a multi-hop mesh network

Security architecture in a multi-hop mesh network. Conference in France, 2006 2006. 9. 26. Presented by JooBeom Yun. Contents. Introduction Problematic State of the art and related works Ad-hoc network security Users’ access to wireless networks Proposed security architecture

shira
Download Presentation

Security architecture in a multi-hop mesh network

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Security architecture in a multi-hop mesh network Conference in France, 2006 2006. 9. 26. Presented by JooBeom Yun

  2. Contents • Introduction • Problematic • State of the art and related works • Ad-hoc network security • Users’ access to wireless networks • Proposed security architecture • PANA framework • Technical description • Security analysis of the solution • Future works • Conclusions Security architecture in a multi-hop mesh network

  3. Introduction • Multi-hop mesh network • Extension of a wireless mesh network by an ad hoc network • Authentication mechanism is essential • In wireless network and in an ad hoc network • The biggest problem • Authentication of the mobile node Security architecture in a multi-hop mesh network

  4. Problematic • Multi-hop mesh network inherits from the security problems • Ad-hoc networks • Passive eavesdropping, message replaying, message distorsion, active impersonation • DoS • Mesh network (Fake APs) • Eavesdropping, tampering, DoS • Access control enforced by operators • Authentication, authorization • Protect data exchanges Security architecture in a multi-hop mesh network

  5. State of the art and related works • Ad-hoc network security • Covers secure routing, key establishment, authentication, certification/revocation services • Secure routing • designed security protocols - ARAN[1], Ariadne[2], SAODV[3] • Certification and revocation services • Threshold cryptography[5,6], ID-based cryptography[7], both cryptography[8] • Users’ access to wireless networks • IEEE 802.1X standard • EAP(Extensible Authentication Protocol) messages between the user and the AP • PANA(Protocol for Carrying Authentication and Network Access) protocol • Medium independent solution • EAP messages to be carried over IP Security architecture in a multi-hop mesh network

  6. Proposed security architecture • IEEE 802.1X • Mobiles may be authenticated by the mesh AR • Authentication is done at layer 2 (MAC address) • The mobile is assumed to be directly attached to the mesh routers • PANA • Authenticate using the IP protocol • EAP lower-layer • Any EAP method is suitable for authentication • PANA framework • Technical description • Security analysis of the solution Security architecture in a multi-hop mesh network

  7. PANA framework • PANA Client (PaC) • Request authentication, provide the credentials • PANA Authentication Agent (PAA) • Interacts with the AS to determine the access control state and communicates EP • Enforcement Point (EP) • Controls access of a new node to the network • Authentication Server (AS) • Verify the credentials of a node requiring access to the network • Asked by the PAA Security architecture in a multi-hop mesh network

  8. Technical description (1/3) Configuration (e.g. DHCPv4) PANA Discovery phase and begin of Authentication and authorization phase Authorization [IKE-PSK, PaC-DI, Session-id] PANA-Bind-Request / PANA-Bind-Answer IKE SA Security architecture in a multi-hop mesh network

  9. Technical description (2/3) Encapsulation of EAP packets during PANA authentication Security architecture in a multi-hop mesh network

  10. Technical description (3/3) • EAP-MD5 • Login/password • Known vulnerabilities (dictionary and brute-force attacks) • Does not support mutual authentication • EAP-TLS • Secure and robust against attacks • Mutual authentication • Protect network access by providing an IKE-PSK Security architecture in a multi-hop mesh network

  11. PANA/EAP-TLS authentication procedure (1/2) PANA-Auth-Request (EAP-Request/Identity) ① ② PANA-Auth-Answer (EAP-Response/ Identity (MyID)) Access-Request (EAP-Response/ Identity (MyID)) ③ PANA-Auth-Request(EAP-Request/EAP-Type=EAP-TLS(TLS Start)) Access-Challenge(EAP-Request/EAP-Type=EAP-TLS(TLS Start)) ④ PANA-Auth-Answer(EAP-Response/EAP-Type=EAP-TLS(TLS Client-hello)) Access-Request(EAP-Response/EAP-Type=EAP-TLS(TLS Client-hello)) ⑤ PANA-Auth-Request(EAP-Request/EAP-Type=EAP-TLS(TLS Server_hello, TLS certificate, [TLS server_key_exchange,][TLS Certificate_request,] TLS server_hello_done)) Access-Challenge(EAP-Request/EAP-Type=EAP-TLS(TLS Server_hello, TLS certificate, [TLS server_key_exchange,][TLS Certificate_request,] TLS server_hello_done)) Security architecture in a multi-hop mesh network

  12. PANA/EAP-TLS authentication procedure (2/2) ⑥ PANA-Auth-Answer (EAP-Response/ EAP-Type=EAP-TLS (TLS Certificate, TLS client_key_exchange, [TLS certificate_verify,] TLS Change_cipher_spec, TLS finished)) Access-Request (EAP-Response/ EAP-Type=EAP-TLS (TLS Certificate, TLS client_key_exchange, [TLS certificate_verify,] TLS Change_cipher_spec, TLS finished)) ⑦ PANA-Auth-Request(EAP-Request/EAP-Type=EAP-TLS(TLS Change_cipher_spec, TLS finished)) Access-Challenge(EAP-Request/EAP-Type=EAP-TLS(TLS Change_cipher_spec, TLS finished)) PANA-Auth-Answer (EAP-Response/ EAP-Type=EAP-TLS) EAP-Response/ EAP-Type=EAP-TLS PANA-Bind-Request (EAP-Success,Device-Id,[protection-Cap],MAC) Access-Accept(EAP-Success) PANA-Bind-Answer (Device-Id,[protection-Cap],MAC) Security architecture in a multi-hop mesh network

  13. IPsec/IKE protection • Multi-hop environment • Access control need to operate at the network layer or upper layers • IPsec protocol suite • Support strong access control to authenticate packets’ origin • Provide data encryption (using ESP) • In order to setup an IPsec security • initiate IKE exchanges • authenticate to each other. Security architecture in a multi-hop mesh network

  14. Security analysis of the solution (1/2) • Protection against replay attacks • Spoofing messages • Sequence numbers are randomly initialized at the beginning of the session • Protection against PaC DoS attacks • Spoofed message • MAC protection • Providing message integrity • Service theft attack • provides message integrity and protects the PaC’s identifier. • Spoofing PAA message • An attacker can spoof PAA messages • Less secure authentication method • negotiate parameters after the establishment of PANA security association Security architecture in a multi-hop mesh network

  15. Security analysis of the solution (2/2) • PAA DoS attack • Overload the PAA with PANA-PAA-Discover messages • Add a cookie (Device ID) to the PANA-Start-Request message • DHCP DoS attack • DoS attacks are possible by depleting the IP address space • Other possible attacks • Ad-hoc and mesh networks • vulnerable to passive eavesdropping, message replaying, message distorsion, easy man-in-the-middle, active impersonation, DoS, IP spoofing • Cryptographic technics(IPsec) – prevent eavesdropping, message distorsion, active impersonation • Mesh networks • Worst DoS is not possible (using access control) • Access control, cryptographic technics Security architecture in a multi-hop mesh network

  16. Future works • The proposed architecture • combines PANA with EAP-TLS in a multi-hop mesh network. • EAP-TLS • Mutual authentication and strong robustness against attacks • Heavy treatment (the use of asymmetric cryptography) • Need PKI • EAP-MD5 • Simpler • Vulnerable to eavesdropping attacks • Working • combine the simplicity of EAP-MD5 and the robustness of EAP-TLS • PANA exposes to IP address starvation in IPv4. • Adapting IEEE 802.1X to multi-hop mesh networks (new research direction) Security architecture in a multi-hop mesh network

  17. Conclusions • Access network security in a multi-hop mesh network • access control • data protection • IEEE 802.1X standard • can be extended to support authentication in multi-hop mesh networks • It’s not easy (modify the standard) • A combination of EAP-TLS over PANA and IPsec has been proposed. • PANA is relying on the availability of IP addresses. • IPv6 • Temporary private addresses Security architecture in a multi-hop mesh network

  18. Q & A Security architecture in a multi-hop mesh network

More Related