1 / 18

An Example Protocol for FastAKM

An Example Protocol for FastAKM. Authors:. Date: 2010-01-19. Abstract. FastAKM framework reduces time to set up association between AP and non-AP STA. This results in reduction of blackout time on handover and enables us to use VoIP in 802.11 “mobile” environment.

myrnao
Télécharger la présentation

An Example Protocol for FastAKM

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. An Example Protocol for FastAKM Authors: Date: 2010-01-19 Hiroki Nakano, Trans New Technology, Inc.

  2. Abstract FastAKM framework reduces time to set up association between AP and non-AP STA. This results in reduction of blackout time on handover and enables us to use VoIP in 802.11 “mobile” environment. We show technical possibility by introducing an trial of example implemention of FastAKM, which establishes an association between AP and non-AP STA by single round-trip exchange of management frames. Hiroki Nakano, Trans New Technology, Inc.

  3. Requirements • Employ just ONE round-trip exchange of frames • STA to AP, then AP to STA • Do all things to start user’s data exchange • Association • Authentication • Key Exchange • No direct contract between AP and non-AP STA • ‘Authentication Server’ mediates between AP and non-AP STA • For separation of service providers and AP infrastructure • Possibly compatible with existing 802.11 framework • Old STAs can be still operated together. Hiroki Nakano, Trans New Technology, Inc.

  4. An Example Procedure by 802.11-2007 STA AP RADIUS Server Beacon Probe Request Probe Response Open System Authentication Open System Authentication Association Request Association Accept EAPOL-Start EAP-Request/Identity EAP-Response/Identity RADIUS-Access-Request/Identity RADIUS-Access-Challenge/TLS-Start EAP-Request/TLS-Start EAP-Response/TLS-client Hello RADIUS-Access-Request/Pass Through RADIUS-Access-Challenge/ Server Certificate EAP-Request/Pass Through EAP-Response/Client Certificate RADIUS-Access-Request/Pass Through RADIUS-Access-Challenge/Encryption Type EAP-Request/Pass Through EAP-Response RADIUS-Access-Request RADIUS-Access-Accept EAP-Success EAP-Key Hiroki Nakano, Trans New Technology, Inc.

  5. Complaint about the Procedure… STA AP RADIUS Server Beacon Probe process is optional Open System auth. is meaningless Probe Request Probe Response Open System Authentication Open System Authentication Association Request Association Accept Any other framework than EAPOL?? EAPOL-Start EAP-Request/Identity EAP-Response/Identity RADIUS-Access-Request/Identity RADIUS-Access-Challenge/TLS-Start EAP-Request/TLS-Start EAP-Response/TLS-client Hello RADIUS-Access-Request/Pass Through RADIUS-Access-Challenge/ Server Certificate EAP-Request/Pass Through EAP-Response/Client Certificate RADIUS-Access-Request/Pass Through RADIUS-Access-Challenge/Encryption Type EAP-Request/Pass Through EAP-Response RADIUS-Access-Request RADIUS-Access-Accept EAP-Success EAP-Key Hiroki Nakano, Trans New Technology, Inc.

  6. Trial 1: Omit Pre-RSNA Auth. Process • We use “Open System” authentication on Pre-RSNA framework at anytime. • Anyone using Shared Key auth? • “Open System auth. is a null auth. algorithm. Any STA requesting Open Systemauth. may be authenticated” Quoted from 802.11-2007 section 8.2.2.2 • Nevertheless, it takes ONE round-trip time to do that! • Standard should be changed to allow to run Association process without Open System authentication process. • Any problem occurs? Hiroki Nakano, Trans New Technology, Inc.

  7. Reason of existence of Open System auth. • “NOTE 3—IEEE 802.11 Open System authentication provides no security, but is included to maintain backward compatibility with the IEEE 802.11 state machine (see 11.3).” Quoted from 802.11-2007 section 8.4.1.2.1 b) Hiroki Nakano, Trans New Technology, Inc.

  8. 802.11-2007 Figure 11-6 Hiroki Nakano, Trans New Technology, Inc.

  9. Modified Figure? Association with FastAKM Hiroki Nakano, Trans New Technology, Inc.

  10. Trial 2: Piggyback Auth. Info. onto Association Request/Response • Can “Mutual Authentication” be done by just A round-trip of Association Request/Response? • “Single Round-trip Authentication” is a common problem. STA AP Authentication Server Beacon (Probe Request) (Probe Response) Authentication (Open System) Authentication (Open System) Association Request Access Request Access Response Association Response (Accept) Hiroki Nakano, Trans New Technology, Inc.

  11. Supposed Service Model Contract to provide wireless access to users specified by Authentication Server (i.e. Service Provider) Set up secure communication channel to exchange information about users Contract to provide wireless access via AP infrastructure. Share information to identify each other properly, e.g. username, password, digital certificate, etc. Real wireless communication channel Provide wireless access in request of Service Provider Hiroki Nakano, Trans New Technology, Inc.

  12. Technical Prerequisite Information shared - to identify each other and - to exchange data securely Station (non-AP STA) Authentication Server (AS) Wireless communication Access Point (AP) • Secure communication pipe • - Information shared to identify each other Hiroki Nakano, Trans New Technology, Inc.

  13. Association and Authentication Procedure • STA  AP • Auth. Server Selector = name of Auth. Server • User Information pack passed through AP toward Auth. Server • User Identifier and a kind of digital signature • Encrypted session key • Countermeasure against replay attack • AP  AS • User Information pack • AP  AS • Plain (decrypted) session key • STA  AP • Proof of AP having legitimate session key • Group key Hiroki Nakano, Trans New Technology, Inc.

  14. Frame Exchange for Authentication User Information pack - User Identifier - a kind of digital signature - Encrypted session key - Countermeasure against replay attack 1 Station (non-AP STA) Authentication Server (AS) Auth. Server Selector Access Point (AP) - Proof of AP having legitimate session key - Group key 3 Plain (decrypted) session key 2 Hiroki Nakano, Trans New Technology, Inc.

  15. An Example Implemetation • OS: NetBSD 5.0.1(i386) • Upper MAC Layer: NetBSD’s net80211 • WLAN Chipset: Atheros Communications AR5212 • Add about 200 lines in C. Hiroki Nakano, Trans New Technology, Inc.

  16. Difference from 802.11-2007 • Additional state transition to skip Open System Auth. • Figure 11-6—Relationship between state variables and services • Two additional elements to Table 7-26 Element IDs • Authentication Server Selector(240temporally) • User Information Pack (241 temporally) • RSN with key obtained by new FastAKM framework • 7.3.2.25 RSN information element (for beacon and proberesp.) • Both Group and Pairwise Cipher Suites are set to CCMP. • AKM Suite is set to the brand-new one! • Define new AKM Suite(00-d0-14-01 is used temporally.) • Assign officially on Table 7-34AKM suite selectors in future… Hiroki Nakano, Trans New Technology, Inc.

  17. Conclusion • Not-so-many changes enables FastAKM framework. • We need more technical discussion • to build and verify authentication method • about any effect of changing standard • to write down detailed specification Hiroki Nakano, Trans New Technology, Inc.

  18. Straw Poll “Does WNG think that we need tutorial session exploring the need for support for mobile communication ?” • Yes: • No: 0 • Don’t Care: Hiroki Nakano, Trans New Technology, Inc.

More Related