IKEv2 authentication exchange model and performance analysis in mobile IPv6 networks

This document describes new Elliptic Curve Cryptography (ECC) groups for use in the Internet Key Exchange (IKE) and Internet Key Exchange version 2 (IKEv2) protocols in addition to previously defined groups. Specifically, the new curve groups are based on modular arithmetic rather than binary arithmetic. These new groups are defined to align IKE and IKEv2 with other ECC implementations and standards, particularly NIST standards. In addition, the curves defined here can provide more efficient implementation than previously defined ECC groups. This memo provides information for the Internet community.

This document describes new Elliptic Curve Cryptography (ECC) groups for use in the Internet Key Exchange (IKE) and Internet Key Exchange version 2 (IKEv2) protocols in addition to previously defined groups. Specifically, the new curve groups are based on modular arithmetic rather than binary arithmetic. These new groups are defined to align IKE and IKEv2 with other ECC implementations and standards, particularly NIST standards. In addition, the curves defined here can provide more efficient implementation than previously defined ECC groups. This version incorporates the erratum for RFC 4753, which changes the format of the Diffie-Hellman shared secret value.

As quantum computing advances, migrating Internet Key Exchange version 2 (IKEv2) to the scenario of post-quantum cryptography (PQC) is critical for protecting IPsec VPNs. The current solution standardized by the Internet Engineering Task Force (IETF) introduces IKE_INTERMEDIATE exchanges with fragmentation. However, its inherent reliance on a full-message retransmission model causes a severe performance issue in lossy networks. While previous research has quantified this exponential overhead, it has not resolved the underlying conflict between fragmented transmission and full-message retransmission. To address this inefficiency, this paper proposes a lightweight, cache-based selective retransmission mechanism using bitmap acknowledgments. We construct a theoretical model to reveal the root cause of the standard scheme’s overhead and design our backward-compatible solution. A prototype is then implemented and validated on the strongSwan platform. Results demonstrate that our mechanism reduces additional transmission overhead by over 60% under lossy conditions. This work provides a critical optimization for deploying post-quantum protocols in realworld environments, enabling the practical application of large-payload PQC algorithms.

A network-assisted mobile VPN for securing users data in UMTS

A powerpoint presentation is given. The paper discusses the experimental evaluation of the performance costs of different IKEv2 authentication methods. Internet key exchange version 2 protocol negotiates security associations for IPsec, authenticates the peer, supports the extensible authentication protocol methods and a candidate technology in future AAA frameworks which is a major issue in next generation wireless networks.

Fast Handoff is one of the major requirement of the next generation wireless networks. Providing mobile stations with prior knowledge of the neighboring Access points (AP) can assist them in taking a fast and accurate link layer Handoff decisions. Collection of neighbor information at Access points and further disseminating this information to the mobile stations attached to a given AP is a challenging task. But, this task should be accomplished without making changes to the 802.11 standards or any huge client/AP modifications. Computational complexity and backward compatibility of such schemes is also an important issue. We have proposed an efficient method of disseminating neighboring AP channel information to the stations. Purpose of providing neighboring AP information to the stations is to reduce the number of channels scanned at the time of Handoff. Stations can use this information in conjunction with the existing syncscan algorithm[2] to achieve faster hand off. We have mathematically analyzed this scheme and proved that signaling overheads due to this scheme are well within the permissible limits. This approach is also backward compatible with the conventional Handoff approaches.

The seamless internetworking among various communication networks is in demand to provide anywhere, anytime connectivity with high data rate and enhanced service quality. In this paper, we propose a novel internetworking architecture between WLAN and UMTS cellular networks, hybrid coupling with radio access system (HCRAS), based on IPv6, mobile IP, and fast hand off techniques. Inheriting loose coupling internetworking techniques, HCRAS utilizes IEEE 802.16 standard air interface to set up direct wireless communication between base stations in UMTS cellular networks and local WLAN. In particular, we propose two new algorithms for intersystem communications and vertical handoff management in HCRAS system. The HCRAS can dynamically distribute traffic among the internetworking networks and reduce signaling cost and hand off latency significantly. Through mathematical analysis and numerical results, it is shown that HCRAS outperforms the tight-coupling and loose-coupling in various scenarios in terms of system routing efficiency, signaling cost, and handoff cost.

Group-oriented applications require multicast communication for distributing information among the group members efficiently. The deployment of such kind of applications in strategic and military grade organizations needs the group-oriented mechanism. The concerns involved in multicast communication are forward and backward security, source/recipient identification and authentication, key revocation and secure rekeying. This paper proposes a source specific centralized multicast scheme based on IPSec infrastructure by addressing these security challenges. The management, in proposed multicast scheme, has been carried out using the Group Internet Key Exchange (G-IKE v2) version 2 protocol.

In this paper, we show that a previously published paper proposing both key establishment and node authentication protocols actually fails to provide the much needed security. In particular, we show a number of ways to compromise these protocols. To overcome flaws of these protocols, we propose novel protocols that remedy all the found security problems of the previous ones. Additionally, our proposals are by the state of the art computationally, energy and memory efficient.

Kerberos is a widely-used network authentication protocol based on a trusted third-party. PKINIT, an enhanced Kerberos protocol which uses PKI mechanism, can prevent the password guessing attack, however, it introduces excessive amount of computational power. To enhance the security performance and computation efficiency of Kerberos, in this paper an improved Kerberos protocol based on Diffie-Hellman-DSA (DH-DSA) key exchange is proposed. Mutual authentication and key exchange between the client and Authentication Server (AS) can be simultaneously achieved with the proposed approach. Our experimental and analysis results have demonstrated that this new protocol can resist the password guessing attack and is more efficient and easily deployed than PKINIT.

The integration of wireless sensor nodes (WSNs) in the Internet of things (IoT) may generate new security challenges for establishing secure channels between low-power sensor nodes and Internet hosts. It includes a bunch of challenges right from redefining the existing ones from scratch of legacy codes to the current trend of proposing and designing new key establishment and authentication protocols. This paper is the successful attempt in resource constraint environment like wireless sensor network (WSN) to integrate cipher authentication and lightweight key management solutions in one bundle so that it can be deployed in IoT domains WSN is also a part of IoT. The cipher should be authenticated, lightweight, and should be flexible to use in the cryptanalysis. The cipher gives the better authentication techniques and performance but limited to the flexibility. Lightweight block cipher (LBC) uses less computation and secures the data with low computational cost and it is used for many purposes like radio-frequency identification (RFID) tags and sensor network nodes. Advanced Encryption Standard is applied in many devices for the encryption, but it cannot be applied to the smaller embedded devices like wearable devices, etc. LBC works for the many devices with low resources, and research on the LBC has been increased. In this research, Data Encryption Standard (DES) and analyzed algorithm are used to increase the efficiency in terms of solving time and Improved Fault Analysis (IAFA) is used to increases the security of the LBC in wireless sensor node for IoT.

Many authentication and key exchange protocols are built using an accepted set of standard concepts such as Diffie-Hellman key exchange, nonces to avoid replay, certificates from an accepted author...

This paper proposes a password-based authentication protocol suitable to certification through trustless network or key exchange. While the existing password-base protocols certify users through certification authority (CA) between client and server, in the proposed protocol of this paper, the users and the server exchange keys and perform authentication without the help of CA. To ameliorate the drawback of password-based protocols caused by the short length and randomness of password, the proposed protocol uses the signature techniques of ECDSA and the SRP protocol based on Diffie-Hellman key exchange method.

The security of identity authentication and key negotiate is an important foundation of WLAN (wireless local area network) security. We present a new authentication and key exchange protocol wireless key exchange (WKE) using for WLAN. The BAN logic is used to formalize and prove the security of WKE at the same time. At last we combine the WKE and Diffie-Hellman exchange to accomplish key negotiate in mobile IP for WLAN.

CDMA 1x evolution–data optimized (1x EV-DO) is defined in the TIA/EIA IS-856 and IS-835 standards. The security of 1x EV-DO offers authentication, integrity, and encryption capabilities. 1x EV-DO supports authentication of the access terminal (AT) to authorize access to the wireless network, as well as authentication of a subscription to authorize access to the Internet Protocol (IP) network. The system also provides session security via re-authenticating the AT during a session to prevent 1x EV-DO session hijacking and to protect integrity of the user packets. This paper will outline security threats to the 1x EV-DO system, security algorithms, authentication and authorization procedures, and ciphering procedures. The 1x EV-DO security will be detailed here for key exchange, authentication, and encryption functions by supporting the following protocols: security protocol, key exchange protocol, authentication protocol, and encryption protocol. Finally, a summary of 1x EV-DO security evolution will be presented © 2007 Alcatel-Lucent.