IEEE 802.1x [4] model to authenticate the STA to the AAA server using AAA protocols like a Remote Authentication Dial-In User Service (RADIUS) [6] to ...
An Efficient Proactive Key Distribution Scheme for Fast Handoff in IEEE 802.11 Wireless Networks Junbeom Hur, Chanil Park, Youngjoo Shin, and Hyunsoo Yoon Korea Advanced Institute of Science and Technology(KAIST) {jbhur,chanil,yjshin,hyoon}@nslab.kaist.ac.kr
Abstract. Supporting user mobility is one of the most challenging issues in wireless networks. Recently, as the desires for the user mobility and high-quality multimedia services increase, fast handoff among base stations comes to a center of quality of connections. Therefore, minimizing re-authentication latency during handoff is crucial for supporting various promising real-time applications such as Voice over IP (VoIP) on public wireless networks. In this study, we propose an enhanced proactive key distribution scheme for fast and secure handoff based on IEEE 802.11i authentication mechanism. The proposed scheme reduces the handoff delay by reducing 4-way handshake to 2-way handshake between an access point and a mobile station during the re-authentication phase. Furthermore, the proposed scheme gives little burden over the proactive key pre-distribution scheme while satisfying 802.11i security requirements.
1
Introduction
Nowadays, wireless local area network (LAN) systems based on IEEE 802.11 standard [1] are emerging as a competent technology to meet the requirements of users for high-speed wireless Internet connectivity. Due to the lack of mobility support of IEEE 802.11, however, seamless mobile services, particularly for real-time applications such as voice over IP (VoIP) are hard to be served in IEEE 802.11 networks when a mobile station (STA) moves from one access point (AP) to another. Especially, Authentication, Authorizing, and Accounting (AAA) servers are supposed to be located far away from each AP so that the full authentication delay requires about 1000ms [13]. This excessive latency of complete user authentication and security negotiations which should be performed at each AP during handoff can be a main obstacle to seamless services for real-time multimedia applications. Therefore, fast re-authentication and reassociation schemes are essential during handoff between APs. The current IEEE 802.11i [2] security architecture recommends an authentication process to follow EAP/TLS [5]. In addition, IEEE 802.11i makes use of IEEE 802.1x [4] model to authenticate the STA to the AAA server using AAA protocols like a Remote Authentication Dial-In User Service (RADIUS) [6] to
2
prohibit unauthorized access to the network. The complete EAP/TLS authentication, however, causes too large latency to support multimedia services whose overall latency should not exceed 50ms to prevent excessive jitter [12]. To solve this problem, many previous studies proposed fast handoff schemes in diverse aspects [7]–[11]. A. Mishra et al. proposed the proactive key distribution (PKD) scheme using a mobility topology of the network, Neighbor Graph, which tracks potential APs to which an STA may handoff in near future [7]. Based on the PKD scheme that reduces the handoff delay by pre-authenticating an STA to next neighbor APs before handoff, M. Kassab et al. proposed two preauthentication schemes to reduce the authentication exchange duration: PKD with anticipated 4-way handshake, and PKD with inter AP protocol (IAPP) caching [10]. However, these schemes not only heavily burden a current AP with excessive overheads but violate IEEE 802.11i trust assumptions. In this study, an efficient pre-authentication scheme enhancing the proactive key distribution method is proposed. The proposed scheme reduces the number of exchanges for private session key generation between an STA and an AP of the re-association phase by exchanging key-generating materials in the preauthentication phase before handoff. Therefore, the re-authentication delay of 4-way handshake during handoff can be reduced to that of 2-way handshake. In addition, the proposed scheme guarantees security requirements of IEEE 802.11i standard and secure communications between an STA and each AP. The paper is organized as follows. In Section 2, we describe IEEE 802.11ibased handoff mechanisms using the PKD method. In Section 3, we propose an efficient pre-authentication scheme enhanced from the PKD method. In Section 4, we evaluate the proposed scheme compared with the PKD-based preauthentication methods and make a security analysis of the scheme, and remark the conclusion of the paper in Section 5.
2
Related Work
IEEE 802.11i uses IEEE 802.1x [4] framework to authenticate and authorize devices connected to the network. In the IEEE 802.1x framework, a supplicant authenticates to a central authentication server (AS) using an extensible authentication protocol (EAP) [5] like the EAP/TLS. After the mutual authentication, the authenticator and the supplicant establish keying materials, and then the AS directs the authenticator to allow the STA to access the network. 2.1
EAP/TLS Authentication
In the IEEE 802.11i authentication process using the EAP/TLS, the STA and the AAA server mutually authenticate each other based on a certificate from a common trusted certificate authority (CA). The mutual authentication process drives the STA and the AAA server to share a strong secret master key (MK) and to initialize pseudo-random functions (PRF) for generating further key materials. The STA and the AAA server generate a pairwise master key (PMK) separately.
3
STA
AP
AAA Association Delay
(Re) association EAPOL-Start EAPOL-Req(ID) EAPOL-Resp(ID)
Access Request
EAP-TLS:Start EAP-TLS(ClientHello) Authentication Delay
EAP-TLS(ServerHello,ServerCert,Done) EAP-TLS(Client Key Exchange,[Cert], Change Cipher,Finished) EAP-TLS(Change Cipher, Finished) EAP-TLS:empty
MK
MK EAP-Success
Access Accept
PMK
PMK EAPOL-Key:Message(A)
PTK
PMK
EAPOL-Key:Message(B)
PTK EAPOL-Key:Message(C)
4-way handshake delay
EAPOL-Key:Message(D)
GTK
Group key handshake
GTK
Group key handshake delay
Fig. 1. Complete EAP/TLS authentication exchange
P M K = P RF (M K, ‘client EAP encryption’ | ClientHello.random | ServerHello.random).
(1)
Then, the AAA server sends the PMK to the associated AP. After that, the STA and the associated AP perform 4-way handshake through the EAPOL protocol [3] to confirm the PMK between them and to derive a session key, pairwise transient key (PTK). The 4-way handshake is described as follows: 1. Message(A): EAPOL-Key(ANonce, Unicast) – This message contains ANonce, which is a nonce value generated by the AP. Once the STA has received this message, the STA can derive a PTK. This message is not encrypted or integrity-verified. 2. Message(B): EAPOL-Key(SNonce, Unicast, MIC) – This message contains SNonce, which is a nonce value generated by the STA, and a message integrity check (MIC) to protect its integrity. The AP derives the PTK using SNonce and verifies the MIC. If this step succeeds, the AP can confirm that the STA has the correct PMK and PTK, and that there is no man-in-the-middle attack. 3. Message(C): EAPOL-Key(Install PTK, Unicast, MIC) – This message tells the STA that the AP is ready to begin encryption using PTK. If this step succeeds, the STA can verify that the AP has the correct PMK and PTK, and that there is no man-in-the-middle attack.
4
STA MK PMK0
AAA
AP
Mutual Authentication
Neighbor APs
MK PMK0
MK PMKn-1
PMK0 Accounting Request
STA
Neighbor APs
AP
Old Association
PMKn-1 PMKn
Move to a neighbor AP
Notify Request
PMKn
Notify Response
PTK
Access Accept(PMKn)
Re-association 4-way handshake
PTK
Group key handshake
PMKn
(a) Pre-authentication
GTK
GTK
(b) Re-authentication
Fig. 2. Authentication exchange process with PKD
4. Message(D): EAPOL-Key(Unicast, MIC) – After this message is sent, both sides install the PTK and begin data encryption using the PTK. During the 4-way handshake, the STA and the AP generate PTK separately. P T K = P RF (P M K, AN once, SN once, ST Amac , APmac ),
(2)
where ST Amac and APmac represent the MAC addresses of the STA and the AP, respectively. The PTK is shared only between the STA and the currently associated AP for secure communication between them. The confidentiality of the PTK is only based on a secrecy of the PMK because other key-generating materials are exposed. Fig. 1 describes the complete message exchanges and the point of each key generation time during a complete EAP/TLS authentication. 2.2
Proactive Key Distribution
The proactive key distribution (PKD) scheme [7] pre-authenticates an STA to next APs by pre-distributing authentication keys, PMKs, to the neighbor APs of the currently associated AP before handoff. In the PKD method, the PMK is generated through following equations (3): P M K0 = P RF (M K, ‘client EAP encryption’ | ClientHello.random | ServerHello.random), P M Kn = P RF (M K, P M Kn−1 | APmac | ST Amac ), th
(3)
where n represents the n re-association. The P M K0 is generated during a first mutual authentication between an STA and an AAA server. The AAA
5
server pre-distributes the P M Kn to next neighbor APs for pre-authentication. This prevents other dissociated APs from generating the PTK of the currently associated AP and the STA, which follows the IEEE Task Group I (TGi) trust assumption that the only associated AP and the AAA server are trusted [7]. Thus, the mutual authentication process between an STA and an AAA server after handoff is reduced to perform 4-way handshake and group key handshake as shown in Fig. 2. The PKD method reduces the full authentication delay of about 1000ms to the re-authentication delay of 60ms [13], but still exceeds the expected latency for real-time applications. 2.3
Other Approaches for Pre-authentication
Recently, M. Kassab et al. proposed two pre-authentication methods based on the PKD method [10]. The main idea of these methods is to reduce the reauthentication delay by performing 4-way handshake in the pre-authentication phase at the expense of additional loads at the AP and the STA and security degradation. PKD with IAPP Caching In the PKD with IAPP caching method, a current AP calculates all the P T Kx for its neighbor APx separately using the PMK, and pre-distributes the P T Kx and its valid time value to the corresponding neighbor APx through the inter access point protocol (IAPP) [3]. Upon handoff to a new APx , the STA derives the P T Kx and authenticates itself to the AP with the P T Kx through the group key handshake. Thus, the re-authentication phase is reduced to the group key handshake process without 4-way handshake. This re-authentication, however, is temporary authentication, which remains valid only within the time limit. After the time limit, the STA and the AP should authenticate each other and generate a permanent PTK for secure channel again. PKD with Anticipated 4-way Handshake In the PKD with anticipated 4-way handshake method, an STA and neighbor APs perform 4-way handshake through the current AP in the pre-authentication phase in advance. Thus, this method also reduces the re-authentication delay to the only group key handshake delay. To carry out 4-way handshake, the STA receives a list and MAC addresses of neighbor APs of the current AP from the AAA server. So, the STA can generate PTKs with the neighbor APs through its current AP using P M Kn s.
3
Efficient Proactive Key Distribution
In this section, a pre-authentication scheme based on the PKD method is proposed for fast handoff in the IEEE 802.11 network environment. The main idea of the proposed scheme is to perform 2-way handshake during a pre-authentication phase and perform remaining 2-way handshake during a re-authentication phase while satisfying security requirements of the IEEE 802.11i standard.
6
3.1
Modified EAP/TLS Authentication
To exchange the nonce values between an STA and APs in the pre-authentication phase, the STA transmits its nonce value to an AAA server through the following modified message exchange during the first full EAP/TLS authentication: EAP-TLS:empty −→ EAP-TLS(SNonce). Then, the AAA server stores the nonce value received from the STA and delivers it with the PMK to the associated AP. Upon receiving the nonce value, the AP can generate the PTK for the STA. Then, the AP transmits its nonce value and MIC to the STA to verify that the AP has the correct PMK and PTK through the modified EAP-Success message exchange: EAP-Success −→ EAP-Success(ANonce, MIC). Therefore, thereafter only 2-way handshake is required to establish the PTK between the STA and the AP, and check the integrity of the keying materials. The 2-way handshake process is described as follows: 1. Message(A): EAPOL-Key(Install PTK, Unicast, MIC) – This message tells the AP that the STA is ready to begin encryption using the PTK. If this step succeeds, the AP can verify that the STA has the correct PMK and PTK, and that there is no man-in-the-middle attack. 2. Message(B): EAPOL-Key(Unicast, MIC) – After this message is sent, both sides install the PTK and begin data encryption using the PTK. 3.2
Authentication with the Efficient PKD
After the first mutual authentication between an STA and an AAA server, the AAA server requests neighbor APs of the current AP to pre-authenticate the STA by sending the corresponding PMK and SNonce of the STA. Upon receiving them from the AAA server, the neighbor APs generate their own PTK for the STA during a pre-authentication phase and respond to the AAA server with their own nonce values and MICs of the message. Upon receiving them, the AAA server transmits a list of neighbor APs, their nonce values, and MICs to the STA. After that, the STA generates PMKs and PTKs corresponding to each neighbor AP and verifies that each neighbor AP has the correct PMK and PTK. If these steps succeed, the AAA server completes the pre-authentication phase by transmitting an access accept message to the neighbor APs as described in Fig. 3(a). Upon handoff, the STA selects the corresponding PMK and PTK to the reassociated AP among the keys which were generated in the pre-authentication phase. Then, the STA and the AP check for the integrity of the keys and install
7
STA MK PMK0
AP
Mutual Authentication
AAA
Neighbor APs MK PMKn-1
MK PMK0
PMK0 Accounting Request
… PMKn PTK
STA
Neighbor APs
AP
Old Association
PMKn-1 PMKn PTK
Move to a neighbor AP Select PMK and PTK
Notify Request (PMKn,SNonce)
Notify Response Notify(List_Neighbor, (ANonce,MIC) ANonce,MIC) Access Accept
PMKn PTK
PMKn PTK
Re-association 2-way handshake Group key handshake
GTK
(a) Pre-authentication
GTK
(b) Re-authentication
Fig. 3. Authentication exchange process with efficient PKD
the PTK by performing 2-way handshake. Therefore, re-authentication exchange between the STA and the AP is reduced to the 2-way handshake and the group key handshake as in Fig. 3(b). Compared to the PKD method, our scheme requires one more additional communication exchange for the list of neighbor APs in the pre-authentication phase while reducing 4-way handshake to 2-way handshake in the re-authentication phase.
4 4.1
Protocol Analysis Performance Evaluation
In this section, we analyze and compare the performance of four authentication schemes: PKD, PKD with IAPP caching, PKD with anticipated 4-way handshake, and the proposed scheme. The overall results of the analysis are summarized in Table 1 in which m represents the average number of neighbor APs per each AP. In Table 1, the communication factor represents the necessary number of message exchanges for the PMK and PTK establishment among the entities. The common exchanges of the first full EAP/TLS authentication exchanges, or group key handshake are not included in this analysis. The computation factor represents secret keys, which should be generated by each entity per handoff except the common key P M K0 and MK. The memory requirement factor represents the memory consumption for a neighbor graph (NG) of the current AP, which should be maintained by each entity for key generation in the pre-authentication phase. The AP in the table is the current AP. The IEEE 802.11i security factor represents whether the schemes satisfy the security requirements of the IEEE 802.11i standard: (1) There should be mutual authentication and fresh key derivation at each AP, (2) Mutual authentication should not cause man-in-the-middle attack. The PKD with IAPP caching
8 Table 1. Performance analysis of authentication schemes PKD Communi-
Pre-auth.
m (PMK)
cation Re-auth. 4-way handshake
PKD with
PKD with anticipated
Proposed
IAPP caching
4-way handshake
scheme
m (PMK),
m (PMK) + 1 (list),
m (PMK)
m (PTK)
2m×4-way handshake
+ 1 (list)
0
2-way handshake
4-way handshake, group key handshake Compu-
STA
tation
P M Kn , PTK,
P M Kn , GTK,
P M Kn , PTK,
GTK
PTK, GTK,
m× PTK
GTK
P M Kn , PTK, GTK AP
0
m× PTK
0
0
STA
0
0
local NG
local NG
Requirement AP
0
local NG
0
0
IEEE 802.11i Security
Y
N
Y
Y
Memory
method is very vulnerable to the AP’s compromise and the man-in-the-middle attack because each AP should participate in the process of other APs’ secret key establishment. Thus, even a single AP’s compromise can be a great threat to the security of the whole network. The total communication exchanges for authentication of the proposed scheme is the least compared to the other schemes. The PKD with anticipated 4-way handshake scheme has the shortest re-authentication delay; however, as the network size increases and the neighbor relationship of APs changes frequently, the total authentication efforts of the scheme may increase most greatly due to the overburdened pre-authentication process. Compared to the PKD method, the proposed scheme requires one more communication exchange in the pre-authentication phase and additional storage from the STA for a neighbor list, but reduces the 4-way handshake to the 2-way handshake while keeping the other protocol exchanges intact and satisfying IEEE 802.11i security requirements. This can make the secure and seamless multimedia services in IEEE 802.11 network to be practical whose handoff latency should be less than 50ms in that the re-authentication delay would be reduced from 60ms to the half. 4.2
Security Analysis
Key Freshness To guarantee the freshness of a key derived at each AP, how to refresh the nonce value of an STA can be one of the considerable issues in the proposed scheme. Although the freshness of the PTK can be guaranteed by the freshness of the ANonce, a reuse of the SNonce may make a system vulnerable to the replay attack. An attacker who masqueraded as a participant in the system
9
by forging a MAC address can eavesdrop on every message, remember nonces and MICs of each message, insert forged messages, and replay stored messages with a combination of known nonces and MICs. To refresh the nonce value of the STA, it can be one solution for a trusted AAA server to regenerate the SNonce on behalf of the STA and distribute it to neighbor APs like the P M Kn pre-distribution. That is, SN oncen = P RF (M K, SN oncen−1 , ST Amac , APmac ), where n represents nth re-association of the STA. This nonce value generation process can achieve the freshness of the PTK. In addition, because the MK is securely shared between the STA and the AAA server, no other participants but they can generate or predict the appropriate SNonce per handoff. DoS Attack According to the security verification of 4-way handshake using Murϕ model in [14], the 4-way handshake is analyzed to be vulnerable to a simple attack on M essage(A) that causes PTK inconsistency between the AP and the STA. The attacker who is impersonating the authenticator sends a forged M essage(A) to the STA after M essage(B) of the 4-way handshake. The STA will then calculate a new PTK corresponding to the nonce for the newly received M essage(A), leading to PTK inconsistency so that the subsequent handshakes to be blocked. The vulnerability of the 4-way handshake to DoS attack on the M essage(A) is actualized by the AP-initiated 4-way handshake in which the STA should must accept all messages to allow the handshake to proceed while the AP can initiate only one handshake instance and accept only the expected response within the expected time. So, the memory exhaustion attack on the STA always exists. In the proposed scheme, however, the STA initiates the handshake, thus the STA needs not store all the unexpectedly received nonces and derived PTKs. This prevents the memory exhaustion attack on the typically resource-constrained STA. However, the STA-initiated 4-way handshake is still vulnerable to the DoS attack on the M essage(A). One possible solution is to add a MIC to the M essage(A) using a common secret such as a PMK to prevent an attacker from forging it, and to use a sequence counter to defend against a replay attack.
5
Conclusion
In this study, we proposed an efficient pre-authentication scheme based on the PKD method. The proposed scheme clearly improves the PKD method by reducing the re-authentication delay to 2-way handshake by transmitting nonce values between the STA and APs in the pre-authentication phase without security degradation. An efficient key distribution scheme for fast and secure handoff is an essential technology for secure and quality services in IEEE 802.11 networks. Since the proposed scheme is simple and does not require any impractical trust relationship among network entities, the scheme can be extensively adapted to the PKD-based pre-authentication methods for fast handoff.
10
Acknowledgement This research was supported by the MOST(Ministry of Science and Technology)/KOSEF(Korea Science and Engineering Foundation) through the AITrc (Advanced Information Technology Research Center) and the MIC(Ministry of Information and Communication), Korea, under the ITRC(Information Technology Research Center) support program supervised by the IITA(Institute of Information Technology Assessment). (IITA-2006-C1090-0603-0015)
References 1. IEEE 802.11: Part11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications, IEEE, June 2003. 2. IEEE 802.11i: Amendment 6: Medium Access Control (MAC) Security Enhancements, IEEE Computer Society, July 2004. 3. IEEE 802.11f: Recommnded Practice for Multi-Vendor Access Point Interoperability via an Inter-Access Point Protocol Across Distribution Systems Supporting IEEE 802.11 Operatoin, IEEE, July 2003. 4. IEEE 802.1x: IEEE Standards for Local and Metropolitan Area Networks: Port based Network Access Control, IEEE, June 2001. 5. B. Aboba, D. Simon, PPP EAP TLS Authenticatoin Protocol, RFC 2716, October 1999. 6. C. Rigney, W. Willats, P. Calhoun, Remote Authentication Dial In User Service (RADIUS), RFC 2869, June 2000. 7. Arunesh Mishra, Min-ho Shin, William A. Arbaugh, Pro-active Key Distribution using Neighbor Graphs, IEEE Wireless Communications, vol. 11, February 2004. 8. Sangheon Pack, Hakyung Jung, Taekyoung Kwon, Yanghee Choi, SNC: A Selective Neighbor Caching Scheme for Fast Handoff in IEEE 802.11 Wireless Networks, ACM SIGMOBILE Mobile Computing and Communications Review, October 2005. 9. Sangheon Pack, Yanghee Choi, Fast Inter-AP Handoff Using Predictive Authentication Scheme in a Public Wireless LAN, IEEE Networks, August 2002. 10. Mohamed Kassab, Abdelfettah Belghith, Jean-Marie Bonnin, Sahbi Sassi, Fast Pre-Authentication Based on Proacitve Key Distribution for 802.11 Infrastructure Networks, ACM Workshop on Wireless Multimedia Networking and Performance Modeling (WMuNeP‘05), October 13, 2005. 11. Minho Shin, Justin Ma, William A. Arbaugh, The Design of Efficient Internetwork Authentication for Ubiquitous Wireless Communications, Technical Report CS-TR4617, Digital Repository at the University of Maryland, January 2006. 12. International Telecommunication Union, General Characteristics of International Telephone Connections and International Telephone Circuits, ITU-TG.114, 1988. 13. Bernard Aboba, Fast Handoff Issues, IEEE 802.11-03/155r0, 2003. 14. Changhua He, John C Mitchell, Analysis of the 802.11i 4-Way Handshake, ACM Workshop on Wireless Security (WiSe 2004), October 2004. 15. M. Burrows, M, Abadi, R. Needham, A Logic of Authentication, ACM Transactions on Computer Systems, vol. 8, no. 1, pp. 18–36, February 1990. 16. L. Gong, R. Needham, R. Yahalom, Reasoning about Belief in Cryptographic Protocols, Proceedings of the IEEE Symposium on Security and Privacy, IEEE Computer Society, Silver Spring, MD, pp. 234–248, 1990.
11
Appendix Formal Analysis of The Proposed Protocol Here, we analyze our pre/re-authentication scheme using a logic-based formal analysis tool [15],[16] to ensure that our authentication protocol functions correctly. We deem that authentication is complete between the STA and AP if PTK there is a PTK such that both believe(|=) the share of it( ↔ ): PTK
ST A |= ST A ↔ AP,
PTK
AP |= ST A ↔ AP.
We idealize the protocol below, with ST A and APn as the principals, AS as the AAA server, Ns and Na as the nonce values, M ACAP n as the MAC addresses of APn s, and M ICk {m} as the MIC of the message m encrypted under the key k. (Pre-authentication) M essage 1. AS → APn : P M K, Ns M essage 2. APn → AS : Na , M ICP T K {Na } M essage 3. AS → ST A : M ACAP n , Na , M ICP T K {Na } (Re-authentication) M essage 4. ST A → APn : M ICP T K {} M essage 5. APn → ST A : M ICP T K {} To analyze this protocol, we first give the following assumptions: P MK
ST A |= ST A ↔ AS, P MK AS |= ST A ↔ APn , APn |= AS / Ns (AS is told Ns ), APn |= ](Ns ).
P MK
AS |= ST A ↔ AS, ST A |= AS| ∼ Ns (AS conveyed Ns ), ST A |= ](Na )(Na is fresh),
We analyze the idealized version of our authentication protocol by applying logical postulates of [15] and [16] to the assumptions; the analysis is straightforward. For brevity, we do not describe our deductions, and simply list the final results: Analysis Analysis Analysis Analysis
of of of of
M essage M essage M essage M essage
1. 2,3. 4. 5.
PTK
APn |= ST A ↔ APn PTK ST A |= ST A ↔ APn PTK APn |= ST A |= ST A ↔ APn PTK ST A |= APn |= ST A ↔ APn
This state achieves more than the complete condition of the authentication. Each principal, STA and neighbor APs, knows a shared secret, PTK, with each other and has a knowledge of a shared secret that he believes the other will accept as being shared by the two principals. From this point, they can transfer data securely.
