Résume

L' évolution des technologies sans fil favorise de plus en plus la mobilité, mais il reste cependant des problèmes non résolus liés à la sécurité. Le changement de contexte d'un réseau à l'autre nécessite des procédures qui infligent du délai lié aux procédures 'réseau' ainsi qu'au changement de lien. La sécurité étant requise dans les deux changements.

La procédure d'authentification à un grand impact sur le délai de l'établissement du lien. Cela est encore plus tangible pour une authentification à travers plusieurs domaines. Il en sort que la conception de systèmes d'authentification rapides qui ne compromettent pas le niveau de sécurité est un grand challenge. Dans cette thèse, je propose de manière générale une solution permettant la minimisation de cette latence. L'architecture est décomposée en trois contributions. La première partie se focalise sur une architecture d'authentification décentralisée. Nous introduisons la notion de 'proxy' qui permet de réduire les couts en terme de délai entre points d'accès. Le résultat est un mécanisme permettant de trouver l'endroit de placement optimal dans une architecture arborescente pour minimiser le nombre de messages. Dans la seconde partie, nous proposons un protocole d'estimation de la mobilité (MAP) et de préparation au changement. Cette partie est essentiellement dédiée à des mobilité inter-domaine, coopérant avec les agents de député. La troisième partie traite d'un mécanisme dans l'accès qui permet à des routeurs de bordure de préparer le contexte avant le changement afin encore une fois de réduire les latences. On se base sur des modèles vii viii théoriques de prédiction basés sur des arbres de prédiction et des estimations statistiques des trajets.

List of Figures

Motivation

Inter-wireless technologies, ranging from IEEE 802 networks, such as Wi-Fi, WiMax and personal area network to non-802 networks, such as cellular networks, are rapidly converging. This allows mobile users carrying a multimedia-access device to roam across inter-technology-based networks. For instance, a mobile user currently associated with a cellular network can move and switch into wireless local area networks (WLANs) and vice versa. Time-sensitive applications, such as Voice over IP (VoIP) or video streams, are now possible over WLANs such as those based on the IEEE 802.11 Standard [7]. We anticipate, furthermore, that mobile users will soon be able to cross the border of different domains without disrupting their on-going application sessions. We use the term 'domain' to refer to a functionally independent group of components which form an administration unit or provide a particular wireless technology access service.

Security concerns are of paramount importance to widespread seamless mobility. The handoff performance correlates with inter-wireless link switch latency and network layer latency -with security being required at both levels. Significant research [START_REF] Mishra | An Empirical Analysis of the IEEE 802.11 MAC Layer Handoff Process[END_REF][START_REF] Mishra | Context Caching using Neighbor Graphs for Fast Handoffs in a Wireless Network[END_REF][START_REF] Pack | SNC: A selective neighbor caching scheme for fast handoff in IEEE 802.11 wireless networks[END_REF][START_REF] Shin | Improving the Latency of 802.11 hand-offs using Neighbor Graphs[END_REF] on reducing link switch latency has been done. In contrast, authentication latency varies with mobility. When the mobile user moves around near the centralized server the latency can be minimal, while roaming away from the server can result in considerable latency. The authentication latency has a significant impact especially on the link switch phase in the case of cross-domain mobility because it requires remote contact with a home authentication server. An application for VoIP, for instance, requires the completion of a handoff in less than 50ms for acceptable Quality-of-Service (QoS) [START_REF] Shirdokar | A QoS-based Indoor Wireless Data Network Design for VoIP[END_REF]. Note that the execution of a securing phase is essential as part of a secure handoff mechanism. When the technology curve regarding link switch latency reaches the limit, the authentication latency will become a dominating factor. Clearly, providing a solution to minimize the latency impact without compromising high-level security is a big challenge.

When the mobile node (MN) crosses the domain boundary, authentication latency problems involve a number of factors ranging from the authentication scheme to linking mechanisms between heterogeneous end-systems. For example, message signaling latency requires inter-domain authentication schemes, the efficiency of relevant authentication protocols, and security-relevant resource allocation among heterogeneous end-systems. An MN registers initially with its home authentication server. The server then creates the MN's credential including private information for authentication, authorization and accounting (AAA) [START_REF]Authentication Authorization and Accounting IETF WG[END_REF]. When the MN roams to a foreign domain, it is bound to the foreign server. An authentication request is forwarded to the MN's home server which then verifies its identity (ID), whereas normal authentication requests in the home domain are handled locally without contacting any remote server. The remote contact, caused by the MN's cross-domain handoff, incurs a significant authentication latency that is part of the handoff latency. The need to avoid such remote contact has been stated in [START_REF] Koodli | Fast Handovers and Context Transfers in Mobile Networks[END_REF].

Overview of Mobile Wireless Security

To sum up, the target environment we consider is the wireless access networks combined with WLANs and cellular networks. In such an environment, when the MN crosses the domain boundary and roams around in a foreign domain with ongoing sessions running on the mobile device, the efficiency of the cross-domain authentication system is critical for the real-time performance of the system. In this thesis we present a highperformance authentication architecture to address such latency problems, supporting secure, cost-effective, and scalable cross-domain handoffs.

Overview of Mobile Wireless Security

Two technologies (i.e. WLAN and cellular networks) specify an authentication mechanism. The WLAN authentication system is based on the IEEE 802.11i Standard [12], while the global system for mobile communications (GSM) uses a subscriber identity module (SIM) for authentication (vs. the universal mobile telecommunications system (UMTS) which uses a universal SIM (USIM)). The following is a brief overview of each mechanism, the details of which will be presented in Chapter 2.

The IEEE 802.11i is an improvement on the IEEE 802.11 Standard specifying security mechanisms for WLANs. The goal of the 802.11i authentication is to secure a wireless link that will be established between a legitimate mobile device and access points. The supplicant in the mobile device sends the request via an extensible authentication protocol (EAP) to the authenticator, residing on the access point. The authenticator encapsulates and forwards the request via a specified back-end authentication protocol to the authentication server. In the server, the supplicant's ID is verified in cooperation with an EAP-based authentication protocol. The supplicant and server exchange a series of messages via the authenticator. In case of a successful authentication, they generate a pair-wise master key and, in particular, the server transfers the key to the authenticator via a secure channel e.g. IPsec [START_REF] Kent | Security architecture for the internet protocol[END_REF][START_REF] Thayer | Ip security document roadmap[END_REF]. In turn, the authenticator and supplicant generate a pair-wise temporary key, based on the pair-wise master key with which to protect their communication link.

There are three important units in the authentication of cellular networks [START_REF] Mouly | The GSM System for Mobile Communications[END_REF]: a home location register (HLR) is a database used to store permanent data about subscribers, their service profile, location information and activity status; a visitor location register (VLR) is a database that contains temporary information on subscribers and when the mobile user roams into a new area it contacts an appropriate HLR; and an authentication center (AuC) provides authentication and encryption parameters. Authentication uses a challengeresponse mechanism. A SIM (USIM) runs on the mobile user's device for the authentication of the GSM (UMTS). The SIM stores network state information such as the mobile user's current location area ID. Each SIM is uniquely identified by its SIM serial number, i.e. a 19 or 20 digit unique number identifying an individual SIM card. Note that SIM-based mechanisms authenticate mobile devices rather than mobile users.

Requirements

The following is required to design a high-performance authentication architecture for cross-domain mobility.

• Signaling latency in authentication requests must be minimal. The conventional authentication architecture, i.e. a client-server model, requires all requests to eventually be processed by a single server. In such a scheme, unexpected authentication failures, even for legitimate users, may occur due to authentication traffic congestion. Moreover, remote requests generated in a foreign domain incur a fundamental delay that may increase in proportion to geographical distance between 1.3. Requirements the client's home domain and foreign domain. Therefore, the message delays, due to geographical distance transmission delays, must have a minimal impact on fast handoffs with an acceptable QoS. A means to minimize these delays is to use an appropriate local 'agent' as a 'proxy' for the remote authentication server. However, such agents, as opposed to current AAA-defined agents, are expected to undertake part of the server's authentication policy. In this context, how efficiently the agents are organized is important for high-performance handoffs.

• An authentication system operates in coordination with an authentication protocol defined by the particular service. When the mobile users cross domain boundaries, an appropriate authentication protocol that supports inter-domain authentication is essential. This implies the need for interaction among the mobile user, the server in the visited domain, the server in the domain in which the mobile user has previously resided and the home server. Moreover, such protocols must also support mutual authentication because the mobile user needs to ensure that the corresponding server in a foreign domain is legitimate. Conventional authentication protocols cannot be applied straightforwardly to inter-domain authentication. In such an inter-domain authentication, the protocol requires an efficient message-handshake mechanism since cross-domain message signaling is critical to the performance.

• The authentication server authenticates the mobile, based on its credentials.

Provided that security information derives from the credentials and is used to authenticate it the next time, one can avoid referring to the credentials by propagating the replicas of security information ahead of time to the server's neighbors in adjacent domains. However, propagating the replicas greatly increases storage overhead in the neighbors. A solution to address the storage overhead is to delete obsolete ones at each regular unit of time. The more frequently it verifies, the lower the storage overhead, but it may weaken the effectiveness of propagation; an optimal value of threshold is required to be determined. In addition to the storage overhead, consistency in the propagated replicas must be maintained.

Defined Entities

The following items are defined and used throughout the thesis.

• Mobile (user): carries a mobile device, referred to as mobile station (STA) in cellular networks. The term mobile node (MN) is used interchangeably in IP-based networks. The mobile user or node is an authenticated object as well as authenticating subject in WLANs, while the STA is an authenticated object in cellular networks.

• Authentication server: provides mobile users or devices with authentication services. It also has to forward requests from roaming users/devices to other authentication servers. In addition to the authentication services, the authentication server often generates a pair-wise key to support confidentiality. The key generation may be provided in coordination with other security protocols like TLS or PKI.

• Authenticator: the WLAN access point that relays authentication traffic to and from an authentication server. It is an end-point that eventually establishes a secure link with the supplicant.

• Security context: MN's credentials including private information for AAA [START_REF]Authentication Authorization and Accounting IETF WG[END_REF]. It includes information on mobile user ID, various encryption keys, validity time and so forth. The need to avoid remote contact to access and verify this information has been stated in [START_REF] Koodli | Fast Handovers and Context Transfers in Mobile Networks[END_REF] and the concept of security context has subsequently been introduced in [START_REF] Kempf | Context transfer problem statement[END_REF]. A visiting MN's security context is used by the foreign server to authenticate the MN locally.

• Deputy agent: involved in the authentication process in coordination with the authentication server. It makes use of security context to authenticate the MN. The agent's part in the process is to send a capability signal as detailed in Chapter 3.

• Security context router: a self-organized entity that extends the deputy agent. It manages security contexts. Multiple security context routers are interconnected to form an independent network as detailed in Chapter 5.

What We Achieved

We designed a high-performance authentication architecture by extending the AAA scheme, basically supporting the integration of WLANs and cellular networks. The integrated network can also include other wireless technologies such as WiMAX and Bluetooth personal area network. Figure 1.1 illustrates a prototype of the architecture that represents the integrated network. The multiple agents that may be (extended) deputies are connected to each other in a peer-to-peer manner, while each controls a sub-tree in a hierarchical mannerthe agents may reside on the same physical machine as the server. In this architecture, the authentication requests are processed in distributed agents. Given an authentication protocol that supports inter-domain authentication, collaborating agents enable authentication efficiently by sharing security information. The security information is transferred among the agents; the peer-to-peer-based scheme does not reflect geographical topologies of end-systems. In consequence, an optimized structure, authentication protocol and secu-Figure 1.1: An authentication scheme for the integrated networks. The authentication servers are responsible for a cellular network and/or WLAN. The deputy agents are connected to each other. The mobile users are associated with the access nodes. There possibly exist proxy and relay agents between the access nodes and servers. rity information management characterize the architecture we designed.

Main Contributions

The following are the three main contributions made by this thesis:

• Decentralized Authentication Scheme: Conventional authentication schemes, based on a client-server model, are improved for cross-domain mobility. The current AAA protocols define several agents, including proxy and relay agents, but they do not enforce authentication and authorization. Authentication incurs a round trip time (RTT) due to transmission delays that are proportional to the distance between the server and clients. We define a deputy agent (referred to as an AAA broker in [START_REF] Kim | Improving Mobile Authentication with New AAA Protocols[END_REF]) that performs an important role in the authentication process on behalf of the server; it differs from the server mostly in that the server has knowledge of the clients' permanent information containing its secret key. Instead, the deputy agent is 1.6. Main Contributions responsible for authenticating the MN using the security context pre-fetched from the server. The hierarchical authentication scheme with the deputy agents mitigates the authentication latency dramatically [START_REF] Braun | Efficient Authentication and Authorization of Mobile Users Based on Peer-to-Peer Network Mechanisms[END_REF][START_REF] Kim | Toward Efficient Mobile Authetication in Wireless Inter-domain[END_REF].

• Mobility-adjusted Authentication Protocol (MAP): We propose a cross-domain authentication protocol [START_REF] Kim | Improving cross-domain authentication over wireless local area networks[END_REF]. It functions in two discrete ways. Initially, the mobile client and the server are mutually authenticated from scratch. This procedure results in producing a security context, including ID, pairs of temporary keys, authentication codes and random numbers, validity, and other information. Next, MAP accomplishes minimum handshake in coordination with deputy agents, which contributes to a further reduction in the authentication latency. In contrast to Kerberos [START_REF] Kohl | The kerberos network authentication service (v5)[END_REF] which favors inter-realm authentication, MAP achieves a significant reduction in the authentication latency without degrading high-level security.

• Security Context Router (SCR): This efficiently manages the security context to avoid remote contact with the home server, and is designed as an extension of the deputy agents. The key feature of the SCR is to provide predictive forwarding of the security context, characterized by approximate pattern matching and statistical estimation methods. The main contribution is a combination of effective algorithmic techniques for the acceleration of the handoff procedure, efficient estimation and security context transfer between the pairs of collaborating SCRs, which keep storage overhead to a minimum. Via experiments on a prototype implementation and numerical analysis, we demonstrate the performance benefits of the SCR using two methods and determine how well they lower storage overhead.

Thesis Outline

The remainder of this thesis is organized as follows.

Chapter 2 surveys the state of the art for WLAN and cellular network technologies and their authentication mechanisms, i.e. the IEEE 802.11i and (U)SIM. First, the IEEE 802.11i comprises the IEEE 802.1X that operates in coordination with the AAA and EAPbased protocols, the 4-way handshake and group-key handshake. Second, in addition to the authentication mechanisms, this chapter introduces the related work on fast authentication, including preauthentication and proactive caching of keys. Last, it describes authentication mechanisms (i.e. SIM and USIM) in the cellular network, and approaches to the integration of WLAN and cellular networks.

Chapter 3 concerns a hierarchical authentication scheme by introducing a deputy agent.

First, it presents the effectiveness of the deputy agent via an experiment conducted with the implementation of an AAA-based UMTS application. The scheme is then generalized into a decentralized one that is represented as a mathematical abstract model. Lastly, this chapter quantifies the authentication latency based on the model, and evaluates the performance of the scheme.

Chapter 4 proposes a mobility-adjusted authentication protocol (MAP) for cross-domain mobility. MAP is characterized mainly by mutual authentication and pair-wise key generation. It enhances the performance of the IEEE 802.11i authentication. First, the chapter gives an overview of relevant systems i.e. the IEEE 802.11i mechanism, cross-domainrelated protocols, and prerequisites of BAN logic. We then design MAP, including architecture, defined keys and messages exchanged, and give a detailed description of elementary modules. Afterwards, security concerns are discussed by first proving MAP in BAN logic and observing a variety of possible attacks. The performance of MAP is evaluated, 1.7. Thesis Outline compared with the two protocols presented originally.

Chapter 5 concerns the design of a security context router (SCR). A group of SCRs form an overlay network and manage the security context. This chapter first describes the overall system on which the SCR is eventually built and then defines a mobility model that represents the movement direction of the MNs. We then design the SCR and elaborate on its two key features in predictive forwarding. In addition to these features, the functions of garbage collection and connectivity are described, and an analysis of lowering storage overhead is undertaken. The performance of the SCR is evaluated via simulation and numerical analysis.

Finally, Chapter 6 concludes this thesis with a discussion of possible future research directions, together with closing remarks.

Chapter 2 The State of the Art

In this chapter we present the security mechanisms defined and used in the main wireless technologies, i.e. WLAN and 3GPP, showing their algorithms and main characteristics. We also discuss their limitations in such circumstances as when the mobile node (MNs) intend to move across domains with no disruption of their ongoing sessions. is concatenated to make the RC4 key. A 128-bit WEP key is constructed by combining a string of 26 Hexadecimal (Hex) characters, each of which represents 4 bits, with the 24-bit IV; i.e. 26 × 4 + 24 = 128-bit WEP key. However, there are weaknesses in WEP, including the possibility of IV collisions and alteration in packets. The same traffic key must never be used twice because RC4 is a stream cipher. Even if the purpose of an IV, which is transmitted as plaintext, is to prevent any repetition, a 24-bit IV is not long enough to avoid any collision. Borisov et al. [START_REF] Borisov | Intercepting mobile communications: the insecurity of 802.11[END_REF] discovered several serious security flaws in WEP that result in practical attacks, showing that WEP fails to achieve its security goals. Cam-Winget et al. [START_REF] Cam-Winget | Security flaws in 802.11 data link protocols[END_REF] surveyed a variety of shortcomings in WEP, and Fluhrer et al. [START_REF]Weaknesses in the key scheduling algorithm of RC4[END_REF] presented several weaknesses in the key scheduling algorithm of RC4 and their cryptanalytic significance.

After open system authentication, security parameters that specify encryption algorithms, security policy and other information are exchanged between the MN and access point via association exchanges.

The IEEE 802.1X

In the IEEE 802.1X system the MN and access points primarily correlate with each other; in particular, we refer to applications running on the MN and access points as supplicant and authenticator, respectively. The system is characterized by a port-based network access control. In an uncontrolled port (the authenticator is 'switched off') all traffic is unfiltered, while in a controlled port all traffic is blocked except for protocol data units (PDUs) related to extensible authentication protocol (EAP) [START_REF] Blunk | PPP Extensible Authentication Protocol[END_REF]. When switched on, the authenticator either authenticates a device or user. In the case of mobile device authentication, it is identified by its media access control address (MAC address) that is pre-registered in the authenticator-associated database. In the case of mobile user authentication, the authenticator forwards EAP-based PDUs to a back-end authentication server for authentication. In the case of successful authentication, the port is opened, so that all PDUs are unblocked; otherwise, they remain blocked.

All three roles, i.e. a supplicant, authenticator and back-end authentication server, are necessary to complete an authentication exchange. A given system can adopt one or more of these roles; e.g. an authenticator and a back-end authentication server can be collocated within the same system, allowing that system to perform the authentication functions without the need for communication with an external server. However, the most common implementation of this mechanism involves the use of an authentication server that is external to the authenticators.

Authentication Authorization Accounting

The AAA Working Group in IETF [START_REF]Authentication Authorization and Accounting IETF WG[END_REF] has developed requirements for Authentication, Authorization and Accounting as applied to network access, the definitions of which are as follows:

• Authentication refers to the confirmation that a user who is requesting services is a valid user of the network services requested. Authentication is accomplished via the presentation of an identity and credentials. Examples of types of credentials are passwords, one-time tokens, digital certificates and phone numbers (calling/called).

• Authorization refers to the granting of specific types of service (including "no service") to a user, based on their authentication, what services they are requesting and the current system state. Authorization may be based on restrictions, e.g. time-of-day, physical location, or restrictions with respect to multiple logins by the same user. Authorization determines the nature of the service which is granted to a user. Examples of types of service include, but are not limited to: IP address filtering, address assignment, route assignment, QoS/differential services, bandwidth control/traffic management, compulsory tunneling to a specific endpoint and encryption.

• Accounting refers to the tracking of the consumption of network resources by users. This information may be used for management, planning, billing or other purposes.

Real-time accounting refers to accounting information that is delivered concurrently with the consumption of the resources. Batch accounting refers to accounting information saved until it is delivered at a later time. Typical information gathered in accounting is the identity of the user, the nature of the service delivered, when the service began, and when it ended.

Since the AAA architecture is built based on a client-server model, the clients reside on the front-end authentication entity, such as access points or base stations, and send the authentication request. All authentication requests are processed in the AAA home server. The server is, in general, responsible for the authentication process from (part of) a domain and cooperates with the others to support cross-domain mobility. In addition to the client and server, relay, proxy, redirect and translation agents are introduced. Relay and proxy agents forward requests and responses based on routing-related attributes in the protocol and realm routing table entries. Relay agents do not make policy decisions and examine/alter any attributes in the packets to be forwarded, while proxy agents do.

However, proxy agents do not respond to client requests prior to receiving a response from the server. In other words, it is possible for only the server to respond to the requests.

Redirect agents refer clients to the server and allow them to communicate directly rather than forwarding requests and responses between clients and servers. Translation agents perform protocol translation among other AAA protocols. Consequently, when MNs are within a visited domain, the server in control of the visited domain forwards the requests to the MN's home server. It is clear that the long-distance traffic of message exchanges occurs.

EAP-based Authentication Protocols

EAP [START_REF] Blunk | PPP Extensible Authentication Protocol[END_REF] is a carrier protocol that carries any security protocols; e.g. transport level security (TLS) [START_REF] Dierks | Transport Layer Security protocol version 1.0[END_REF] provides for mutual authentication and key exchange between two endpoints and is carried over EAP-TLS [START_REF] Aboba | PPP EAP TLS Authentication Protocol[END_REF]. In addition to EAP-TLS, there are a variety of EAP-based protocols, like EAP-SIM [START_REF] Haverinen | EAP SIM Authentication[END_REF] for the SIM mechanism, EAP-AKA [START_REF] Arkko | Extensible Authentication Protocol Method for UMTS Authentication and Key Agreement (EAP-AKA)[END_REF] for the zUSIM mechanism, protected extensible authentication protocol (PEAP) [START_REF] Palekar | Protected EAP Protocol (PEAP) Version 2. work in progress[END_REF], EAP-SKE [START_REF] Salgarelli | EAP SKE authentication and key exchange protocol[END_REF], EAP-TTLS [START_REF] Funk | EAP Tunneled TLS Authentication Protocol[END_REF], and so forth. These protocols must provide an authentication mechanism -most of which also support key generation after successful authentication.

They operate, based on a client/server scheme. That is, an EAP peer runs on a supplicant and interacts with a back-end authentication server in the AAA scheme.

Figure 2.1 illustrates the relationship between the supplicant, authenticator and authentication server, as well as the structure of the protocols used. The authenticator's controlled port is basically in the unauthorized state and therefore all PDUs are blocked. However, EAP payloads can pass through the authenticator; the communication between the authenticator and authentication server relies on either RADIUS [START_REF] Rigney | Remote authentication dial in user service[END_REF] or Diameter [START_REF] Calhoun | Diameter Base Protocol[END_REF]. The authentication server either authenticates the supplicant or there is mutual authentication between the authentication server and the supplicant, in both cases using one of the above EAP-based security protocols.

There are 4 types of packets in EAP: Request, Response, Success, and Failure. The authenticator sends the Request packet to the supplicant. Additional Request packets are always sent after a valid Response packet is received. The supplicant must send a Response packet in reply to a valid Request packet, but is not allowed to retransmit it during a given period of time. The Success or Failure packet is sent to the supplicant according to the authentication result.

4-Way Handshake

A successful authentication in the IEEE 802.1X leads to the generation of a pair-wise master key (PMK) shared between the supplicant and authentication server. The key is eventually used for the 4-way handshake taking place between the supplicant and authenticator.

The authenticator receives the PMK from the authentication server via a secure channel.

The IEEE 802.11 uses EAPOL-Key frames to exchange information between the supplicants and authenticators. These exchanges yield cryptographic keys and a synchronization of security association state. The following is a description of each message exchanged in the 4-way handshake, of EAPOL-Key frames. M2. is sent to the authenticator as a reply to M1. It contains the key data field of a robust security network (RSN) information element, a random value, and the message integrity code (MIC) of M2. The RSN information element contains authentication and pair-wise cipher suite selectors, a single group cipher suite selector, an RSN capabilities field, the PMKID count and PMKID list. All supplicants implementing RSN association support this element. The size of the RSN information element is limited by the size of an information element which is 255 octets. On receipt of M2, the authenticator verifies that the pair-wise cipher suite selected is one of its configured cipher suites and that the group cipher suite is consistent. M3. is sent to the supplicant. It contains the key data field of an RSN information element, a random value and an MIC. If a group cipher has been negotiated, it also includes an encapsulated group temporary key (GTK). The authenticator inserts the RSN information element it previously sent in the Beacon/Probe response message.

The supplicant verifies the selected security RSN information with the RSN information element in M3. If the values do not match, the supplicant breaks the association by invoking a Deauthenticate request. A security error is logged at this time.

M4. is sent to the authenticator. It contains the key data field that can be empty or can contain an MIC.

During the 4-way handshake, both the supplicant and authenticator generate a PTK. • The supplicant sends an EAPOL-Key frame containing the SRAND, the RSN information element from the (re)association request frame, and an MIC. The authenticator derives a PTK from the ARAND and SRAND in the same manner as the supplicant, and verifies the MIC in the EAPOL-Key frame.

• The authenticator sends an EAPOL-Key frame containing the ARAND, the RSN • The supplicant sends an EAPOL-Key frame to confirm that the temporary keys are installed.

The authentication server also knows the PMK. Therefore, additional assumptions are required: the authentication server does not expose the PMK to other parties, it does not masquerade as the supplicant to the authenticator or as the authenticator to the supplicant, and it does not masquerade as the supplicant itself or the authenticator. If any of these assumptions are broken, then the protocol fails to provide any security guarantees.

The 4-way handshake uses random values against replay. The ARAND provides replay protection to the authenticator, and the SRAND to the supplicant. In most session initiation protocols, replay protection is explicitly accomplished by selecting a random value and requiring the peer to reflect the received random value in a response message. The 4-way handshake instead mixes the ARAND and SRAND into the PTK, and replays are detected implicitly by MIC failures.

Group-key Handshake

The authenticator uses the group-key handshake, which is optional, to send a new GTK to the supplicants. The following are the message exchanges: M1. authenticator → supplicant: EAPOL-Key(RSC, MIC, GTK[KeyID])

The authenticator generates, encapsulates and sends a new GTK, along with the last sequence number (receive sequence counter (RSC)). The supplicant verifies the MIC, decapsulates the GTK with KeyID obtained during the 4-way handshake, and configures it.

M2. supplicant → authenticator: EAPOL-Key(MIC)

The authenticator verifies the MIC and configures the GTK into the IEEE 802.11 MAC if verification is successful.

If the authenticator does not receive a reply to its messages during a given period of time, it deauthenticates the supplicant, and the supplicant fails to be authenticated.

Fast Authentication Preauthentication

Preauthentication as part of the IEEE 802.11i can be useful for a performance enhancement of handoffs. Figure 2.4 depicts a sequence of a preauthentication process. Before preauthentication, the new AP, with which the MN will be associated, advertises the preauthentication capability in the RSN information element. An MN's supplicant initiates preau- authentication is performed from scratch. The main drawback of preauthentication is that it is highly uncertain that the MN will be associated with the preauthenticated AP.

Proactive Caching of Keys

One can achieve fast authentication with proactive key distribution [START_REF] Mishra | Pro-active Key Distribution using Neighbor Graphs[END_REF]. Figure 2.5 depicts how the AS propagates PMKSAs to relevant APs with which the MN may be associated.

The AS builds neighbor graphs that represent associations among APs [START_REF] Mishra | Context Caching using Neighbor Graphs for Fast Handoffs in a Wireless Network[END_REF]. After the MN completes the 4-way handshake, the AS propagates PMKSAs to the selected APs, referring to a neighbor graph -there is a variant, i.e. a selective neighbor caching scheme [START_REF] Pack | SNC: A selective neighbor caching scheme for fast handoff in IEEE 802.11 wireless networks[END_REF] Figure 2.5: Proactive key distribution. cAP is an AP with which the MN is currently associated. The AS propagates the derived PMKs to APs selected based on a neighbor graph (NG). that propagates a subset of neighbor APs, distinguishing the probability of each AP with which the MN will be associated. Each PMKSA is computed by hashing a combination of MK, the old PMKSA, and the addresses of the MN and each AP, i.e. PMKSA n =H(MK, PMKSA n-1 , MN's MAC Address, AP's MAC Address). When the MN is associated with one of the APs that has PMKSA pre-deployed, the MN and AP perform the 4-way handshake directly without the IEEE 802.1X. If their PMKSA is different, the IEEE 802.1X runs from scratch. The neighbor graphs can also be managed in each AP. If so, then PMKSA is propagated via IAPP [START_REF]IEEE Trial-Use Recommended Practice for Multi-Vendor Access Point Interoperability via an Inter-Access Point Protocol Across Distribution Systems Supporting IEEE[END_REF].

Authentication in 3GPP

The authentication mechanisms in the 3G partnership project (3GPP) [10] are divided into UMTS authentication and GSM authentication. UMTS authentication is based on a USIM for authenticating the MN and network (e.g. authentication server (AuC)) -it implies mutual authentication in contrast to GSM authentication, while GSM authentication is based on a SIM or GSM-capable USIM for authenticating the MN. GSM authentication uses a triplet of parameters: a network challenge (RAND), an expected response value (SRES), and cipher key (Kc); UMTS authentication uses a quintet of parameters: RAND, an expected response (XRES), cipher key (CK), integrity key (IK) and authentication token (AUTN).

The GSM network authenticates the international mobile subscriber identity (IMSI) through the use of a challenge-response mechanism. A 128-bit RAND is sent to the MN.

The MN computes the 32-bit SRES based on the encryption of the RAND with the authentication algorithm (A3) using the personal identity number (PIN). Upon receiving the SRES, the GSM network repeats the calculation. If the received SRES and the calculated value match, the MN is successfully authenticated. Otherwise, the connection is terminated due to an authentication failure. Similarly, the UMTS network uses a challenge-response mechanism. In contrast, it sends a challenge message additionally containing the AUTN.

Upon receiving this message, the USIM in the MN verifies the AUTN, and if it is accepted, the USIM continues to compute the signature of RAND and RES, and then sends RES to the UMTS network while computing a new CK and IK. The UMTS network compares the received RES and XRES. If they match, a mutual authentication is successfully achieved and both the UMTS network and MN eventually generate the Kc from the CK and IK.

The Integration of WLAN and GPRS

WLAN can complement mobile operators' traditional wide-area General Packet Radio Service (GPRS) by offering a cost-effective wireless broadband data solution indoors. Several approaches have been proposed for interworking between WLANs and cellular networks.

The European Telecommunications Standards Institute (ETSI) has specified two generic approaches i.e. tight coupling and loose coupling [START_REF] Etsi | Requirements and architectures for interworking between HIPERLAN/2 and 3rd generation cellular systems[END_REF]. With tight coupling, the WLAN is connected to the GPRS core network via serving GPRS support node (SGSN) and treated as other radio access networks (RANs), such as GPRS RAN and UMTS terrestrial RAN.

Therefore, the WLAN data traffic flows through the GPRS network before reaching IPbased networks. This scheme is primarily tailored to support WLANs operated by cellular operators, and thus hardly supports third-party WLANs. On the other hand, with loose coupling, the WLAN reaches IP networks via an operator's IP network, and is thus connected to the GPRS network via the gateway GPRS support node. The solution to this scheme relies substantially on IETF protocols; i.e. Ala-Laurila et al. [START_REF] Ala-Laurila | Wireless LAN access network architecture for mobile operators[END_REF] presented a new WLAN system architecture that combines WLAN technology with mobile operators' SIMbased subscriber management functions and roaming infrastructure. Salkintzis et al. [START_REF] Apostolis | WLAN-GPRS integration for next-generation mobile data networks[END_REF] compared the two internetworking mechanisms and discussed their advantages and drawbacks. In particular, an authentication system in an integrated network with loose coupling is based on AAA protocols, such as RADIUS and Diameter. the MN roams in a WLAN. At first, the MN's supplicant sends an authentication triggering message, EAPOL-start, to an AP's authenticator (e.g. RADIUS client). In messages 2 to 4, the authenticator obtains the MN's ID -which corresponds to IMSI in the case of GSM and UMTS -and forwards the ID to its back-end authentication server (e.g. RADIUS server). The server notices that the MN belongs to another server in a foreign domain by verifying a domain indicator that is usually set by the supplicant. The RADIUS client can Figure 2.6: An integrated authentication system covering WLANs and cellular networks also attach the domain indicator to which this request will be forwarded, and to do so, preconfiguration in the client is required. When receiving message 5, the MN's home server (e.g. RADIUS server) fetches authentication information, i.e. GSM authentication vectors (UMTS authentication vectors for UMTS) by sending the MN's IMSI (in messages 6 and 7). In messages 8 and 9, the home server sends a random-challenge message, forwarded by the foreign server, to the authenticator. In messages 10 and 11, the MN's supplicant computes an SRES with the received RAND and sends the authenticator the SRES. In messages 12 and 13, the home server matches the SRES received via the foreign server with the XRES. The authentication result is transferred to the MN eventually in messages 14 to 16 (it is a successful authentication in the figure; otherwise RADIUS access-reject and EAP-failure are sent). Afterwards, the 4-way handshake or WEP security can be performed depending on what security mechanism is used to protect the WLAN. Each time the MN roams around in a foreign domain, the above steps are repeated. Therefore, in terms of the performance issue, such authentication mechanisms must be improved.

Introduction

The server in the AAA scheme verifies the MNs' ID, authorizes them to use resources and enforces a security policy on their profile. The server is passive: it waits for requests and sends a reply. The clients, on the other hand, send requests and wait until replies arrive. Such a scheme fundamentally suffers from authentication failures caused by authentication request congestion regardless of MNs' legitimacy, and incurs significant latency in authentication with the MNs roaming in a visited domain.

Since the proxy and relay agents defined in the AAA framework are not allowed to enforce the authentication policy, we introduce a deputy agent that authenticates the MNs on behalf of the server. After successful authentication, the server generates and transfers security information to a deputy agent, so that the deputy agent can process consecutive requests while the MNs are roaming. First, we present an implementation of an AAA-combined 31 UMTS network authentication via which we demonstrate the impact of the deputy agent on authentication latency. The application of the AAA-combined UMTS network authentication (called AAA-UMTS application) generates a set of authentication elements that are included in security information. In addition to the application, we build an abstract model that represents a decentralized scheme that consists mainly of multiple deputy agents, and quantify the authentication latency in message signaling. The evaluation analysis results in determining which deputy agent best handles the authentication process.

The remainder of this chapter is organized as follows. Section 3.2 presents the implementation of the AAA-UMTS application, including command codes and defined attribute values, and describes a UMTS authentication procedure. It then evaluates the performance results of the experiment conducted, with the implementation in a UMTS platform. Section 3.3 details a decentralized authentication scheme with multiple distributed deputy agents, defines an abstract model of the scheme, and quantifies authentication latency in terms of message exchange cost. Section 3.4 evaluates the performance of the model and Section 3.6 concludes this chapter.

AAA-UMTS Application Command Codes

We use the same AA-Request (AAR) and AA-Answer (AAA) messages that are defined in the Diameter network access server application [START_REF] Calhoun | Diameter Network Access Server Application[END_REF]. The messages are captured to apply the UMTS authentication mechanism according to the presence of the attribute value of UMTS-Proxy-Capability. A description of the mechanism is given below.

Defined Attribute Values

• Challenge-Request is of type Enumerated and contains the request-type identifier determining if it is for a request or response.

• UMTS-Proxy-Capability is of type OctetString and contains one octet identifying that there exists a deputy agent capable of serving, as an auxiliary AAA server as described above.

• UMTS-Vector is of type Grouped and contains User-Name, REND and XRES. It may appear in the response to challenge. If no deputy agent is able to handle the attribute value (AV) pair, the only REND is sent to ordinary proxy agents. Its data field has the following ABNF grammar:

UMTS-Vector ::= < AV header > { User-Name } { REND } { XRES } * [ AVs ]
• User-Name is of type UTF8String and contains an ID. REND is of type OctetString and contains 16 octets with the 'P' protection bit enabled. XRES is of type OctetString and contains 16 octets with the 'P' bit enabled.

• Token-Response is of type OctetString and contains 16 octets with the 'P' bit enabled. It is computed and sent to the deputy agent.

UMTS Network Authentication

Provided that the MN visits the UMTS domain, it requests authentication by sending its ID. The AAA client captures this message. The server verifies the presence of the UMTS-Proxy-Capability AV in the message, and if several AVs are found, the server chooses an appropriate agent to handle the request via analysis that will be detailed in Section 3.3. In the experimentation version used for evaluation, however, the one in the domain in which the request was originally issued is chosen. The server generates a random value (REND) and computes expected response (XRES) by applying HMAC algorithms [START_REF] Krawczyk | HMAC: Keyed-Hashing for Message Authentication[END_REF] with the REND and an MN-shared key. It sends the AAA message, including User's ID and multiple UMTS-Vectors of REND and XRES AVs. In case of no UMTS-Proxy-Capability AV found in the AAR message, only a REND AV is included in the message.

M3. Deputy → Client: AAA (User-Name, REND)

The chosen deputy agent extracts the REND from the AAA message and then sends it to the MN to be challenged. M4. Client → Deputy: AAR (User-Name, Challenge-Request, Token-Response)

The MN computes an RES with the shared key and the received REND, and responds with the AAR message, including the Token-Response AV containing the computed RES and the Challenge-Request AV set to a value signifying response.

M5. Deputy → Client: AAA (User-Name, Response)

The deputy agent verifies if the received RES is matched with the corresponding XRES, and then replies with a success/reject message. The next request is treated in the deputy agent without contacting the server. For experimentation purposes, it can forward the request to the proxy agent in the Enst domain. The Diameter server in the Star-vthd domain responds with AV pairs to the deputy agent, and then the deputy agent can enforce the UMTS authentication policy. Therefore, the long-distance traffic of message exchanges is substantially reduced. RTTs between the deputy agent and Diameter server, and between the server and an alternate server correspond to 9.97ms and 1.23ms, respectively. All associations between the client and deputy, the server and deputy, and the server and the alternate server are assumed to be secure. We install multiple proxy agents in the servers in the Enst and Star-vthd domains, and switch their role from server to proxy, alternately, which emulates the increase in their distance. For example, if 2 proxy agents are necessary, the Diameter server in the Starvthd domain forwards the request to the server in the Enst domain as a proxy and then processes the returned request as a home server. Figure 3.3 shows the increase in authentication latency as the distance grows. As expected, the latency gain increases proportionally,

Evaluation of the AAA-UMTS Application

Decentralized Authentication Scheme

In an attempt to secure no false negative failures of authentication by the server and the fast cross-domain handoff process, in this section, we introduce an abstract model of the decentralized authentication scheme consisting of multiple deputy agents, and quantify the authentication latency. Figure 3.4: Mobile authentication scenario; the connections between deputy agents, between AAA clients and agents/servers, between agents and server are assumed to be secure. After crossing the domain boundary, the MN associates with an access point in domain 2, and the request is sent to the home server via two deputy agents adding the joining attribute (e.g. UMTS-Proxy-Capability in the AAA-UMTS application). The server determines which deputy agent will undertake the mobile authentication, taking the latency factors into consideration based on an abstract model, which is detailed shortly. Provided that the deputy agent in domain 4 is chosen, the consecutive requests are processed in that agent regardless of the MN handing off into domain 3.

Mobile Authentication

An Abstract Model

Figure 3.5 illustrates a binary-tree-based abstract model. The root and leaves in the binary tree correspond to the AAA server and clients, respectively. An intermediate node is one of deputy, proxy, and relay agents. We assume that all intermediate nodes can play a deputy role in the mobile authentication. We also assume that costs of exchanging a message between all adjacent nodes is the same (i.e. 1 for simplicity); e.g. the cost of sending and receiving back a message to a 2-hop-distance node is equal to 2. The goal in this model is to choose a deputy agent that allows one to keep the cost to a minimum; e.g. if the MN moves around in group A, then n y may be optimal, and if it moves across groups A and B, then n x may be optimal. Figure 3.5: An abstract model for quantifying cost of message exchanges. Parameters l and g represent the number of access points that the MN traversed and the number of groups that it visited, respectively. N denotes an end-to-end cost and n x , n y , and n z denote the respective heights of the tree corresponding to the deputy agents' positions.

Cost Function:

The following is the derivation of a minimal cost function. When the MN is initially authenticated, the authentication request is sent to the server, which costs N. After a successful authentication, the server calculates a deputy's position that will be somewhere in the middle. Each time the MN moves with l -1 associations (it counts once with a new access point), the request is processed in a chosen deputy agent. Then, the cost with respect to l is

(l -1) log l log 2 + N. (3.1)
If no deputy agent is determined, then the cost is

N × l, (3.2)
which corresponds to a non-optimized authentication scheme as well. We divide l into g groups, i.e. l = l 1 + l 2 + ... + l g , assuming that a deputy agent controls each group of clients.

The sum of costs with respect to each group is

(l 1 -1) log l 1 log 2 + ... + (l g -1) log l g log 2 + gN. (3.3)
Here, we define a convex function for an interval [1, b],

f (x) = g(x -1) log x log 2 ,. (3.4)
Then, Eq. (3.3) is expressed as

1 g ( f (l 1 ) + f (l 2 ) + ... + f (l g )) + gN. (3.5)
For any two points x 1 and x 2 in that interval, f (x) holds 1/2( f (x 1 )

+ f (x 2 )) ≥ f ((x 1 + x 2 )/2).
Therefore, we obtain

1 g ( f (l 1 ) + f (l 2 ) + ... + f (l g )) + gN ≥ f ( 1 g × (l 1 + l 2 + ... + l g )) + gN = f ( l g ) + gN, (3.6)
which is a lower bound of the cost function when l 1 = l 2 = ... = l g = l/g. Therefore, the cost function with respect to g is

f C (g) = (l -g) log l g log 2 + gN. (3.7)
In particular, when g = 1, f C results in Eq. (3.1), and when g = l, it results in Eq. (3.2).

Therefore, reducing the cost of authentication requests allows one to adjust g, which in turn produces an optimal deputy's position.

Approximation to Optimal g: We here attempt to compute g that results in minimizing f C . The derivative of Eq. (3.7) with respect to g is

f ′ C (g) = N + -log( l g ) + 1 -l g log 2 (3.8)
and the second derivative is

f ′′ C (g) = 1 g + l g 2 log 2 , (3.9)
which is strictly positive. Thus, f ′ C is an increasing function, and there are two cases when g = 1 as the basis. ( 1

) If f ′ C (1) ≥ 0, then we deduce that for any g > 1, f ′ C (g) > 0 because f ′ C (g) is the increasing function. That is, when g = 1, f C (g) is minimal -it is true only if f ′ C (1) ≥ 0, i.e. N log 2 + 1 ≥ l + log l. (2) If f ′ C (1) < 0, there exists a value of g satisfying f ′ C (g) = 0 which implies N log 2 = log( l g ) + l g -1.
(3.10)

Considering that log(l/g) ≪ l/g, Eq. (3.10) approximates to l/g ≈ 1 + N log 2. Therefore, g approximating to g opt is

g approx ≈            l 1+N log 2 for N log 2 + 1 < l + log l,
1
for N log 2 + 1 ≥ l + log l.

(3.11)

Latency Gain: The following is a numerical gain in latency from a non-optimized authentication scheme.

f C (l) -f C (g) = (l -g)(N - log l g log 2
).

(3.12)

For N log 2 + 1 < l + log l, the gain is

(l - l 1 + N log 2 )(N - log(1 + N log 2) log 2 ) ≈ l(N log 2 -log(N log 2)) log 2 (3.13)
and for N log 2

+ 1 ≥ l + log l, it is (l -1)(N - log l log 2 ) ≈ (l -1)N. (3.14)
In both cases the gain increases as l →∞or N →∞.

Performance Evaluation

A Good Approximation of g: of reducing the cost as expected. The approximation of g fits g opt perfectly, i.e. when l ≤ 10, a single deputy agent (i.e. g = 1) processes the requests, and when l > 10 multiple deputy agents (i.e. g = 1/(1 + N log 2)) do. Provided that the MN associates with access nodes once and is unlikely to return to the visited access nodes, deputy agents located in the AAA clients (i.e. g = l) show the worst performance.

Dividing access points into multiple groups performs best. As the MN moves away from its home server, the size of its group increases, which means that a deputy agent located higher than the AAA clients is chosen as optimal. As can be seen in Figure 3.7, the level of the deputy agent's position is raised in the two cases of g opt and g approx . The position is stabilized as the MN traverses the access points further, with 4 or 8 access points grouped and controlled by a deputy agent.

Related Work

Examples of applications based on decentralized architectures -a peer-to-peer network -include Napster [4], Gnutella [START_REF] Gnutella | [END_REF], and Freenet [START_REF]Freenet[END_REF]. In Napster, to retrieve a file, a user queries a central server and obtains the IP address of a user machine storing the requested file. The file is then downloaded directly from the machine, i.e. it uses a client-server structure for searching and a peer-to-peer structure for retrieving files. In contrast, in Gnutella, users self-organize an application-level mesh, i.e. using a peer-to-peer structure for all purposes. CAN [START_REF] Ratnasamy | A scalable content-addressable network[END_REF] allows for a scalable peer-to-peer file distribution system by means of hash table-like abstraction in communication models, which maps keys onto values.

Conclusions

In this chapter, we presented an implementation of the AAA-UMTS application and confirmed the effectiveness of the deputy agent in authentication latency. We also presented an abstract mathematical model of the decentralized authentication scheme, and quantified the cost of message exchanges to reduce latency. We confirmed that multiple collaborating deputy agents perform better than a single one, by allowing for a reliable and scalable authentication mechanism. to roam within public/corporate buildings or university campuses. Furthermore, we anticipate that mobile users might cross the domain boundary without their on-going application sessions disrupted. However, VoIP requires a handoff to be completed in less than 50ms for acceptable Quality-of-Service (QoS) [START_REF] Shirdokar | A QoS-based Indoor Wireless Data Network Design for VoIP[END_REF], including the execution of the IEEE 802.11i authentication [12] as part of a secure handoff mechanism.

Minimizing the number of messages to be exchanged is important as cross-domain authentication needs to contact the remote home server. Moreover, authentication latency increases in proportion to the round-trip time between two points involved in inter-domain message exchanges. Optimization of the authentication protocol is of utmost importance since an existing redundant combination of authentication and key negotiation functions incurs more rounds of message exchange than necessary.

We propose an enhanced protocol for cross-domain authentication, Mobility-adjusted Authentication Protocol (MAP) that relies on far less costly symmetric cryptography. present in this chapter. An SCR also plays a role of an authentication server in a foreign domain; it provides security context for MAP operating as if in the home server. Via a prototype implementation, our evaluation results show that cross-domain authentication latency of MAP accounts for 74% and 85% that of Kerberos [START_REF] Kohl | The kerberos network authentication service (v5)[END_REF] and Needham-Schroeder symmetric-key protocol (NS) [START_REF] Roger | Using encryption for authentication in large networks of computers[END_REF][START_REF] Roger | Authentication Revisited[END_REF], respectively. It makes up to 53% improvement in authentication latency which is proportional to the end-to-end domain distance until the round-trip time counts up to 100ms.

The remainder of this chapter is organized as follows. Section 4.2 gives an overview of the 802.11i authentication mechanism, the related cross-domain protocols, design requirements, and prerequisites of BAN logic. Section 4.3 first describes MAP including its architecture and a relevant interaction between SCRs. Subsequently we details defined keys and types of messages, an example of message exchanges for a successful authentication, and the corresponding pseudo code of each module. Section 4.4 considers possible threats and analyzes the security of MAP. Section 4.5 examines the performance via measurements and simulation. Finally, we discuss related work in Section 4.6 and conclude the chapter in Section 4.7.

Overview of Authentication Mechanism and Requirements

In this section, we first introduce the 802.11i authentication scheme and protocols applicable to the cross-domain authentication, and then describe the design requirements of authentication protocols. Finally, we explore prerequisites to BAN logic.

The IEEE 802.11i Authentication

The IEEE 802.11i authentication is responsible for mutual authentication and key derivation for securing WLANs via the IEEE 802.1X and 4-way handshake [12]. Figure 4.1 shows a typical scenario of message exchanges in the context of the IEEE 802.11 and 11i.

Our focus is on two main steps after (re)association. First, the IEEE 802.1X authentication, where an authentication protocol like TLS [START_REF] Dierks | Transport Layer Security protocol version 1.0[END_REF] operates, is to verify the authenticity of end-to-end principals: the mobile (STA) and the authentication server (AS) via the authenticator (AUTH) (which operates in an AP). In particular, the AUTHs and AS construct an AAA architecture. Successful mutual verification of each identity leads to the derivation of a pair-wise master key (PMK). This key is transferred to the AUTH via a secure tunnel. Second, the STA and AUTH perform the 4-way handshake, exchanging their nonces, Figure 4.1: Message exchanges in the IEEE 802.11 and .11i systems so that a pair-wise temporary key (PTK) with which the wireless link will be secured is produced using the PMK as a seed.

The performance of the IEEE 802.11i authentication depends on the efficiency of this authentication protocol. Recent efforts on security associations have been limited to distribution of keys to access points within a domain [START_REF] Mishra | Pro-active Key Distribution using Neighbor Graphs[END_REF]. For inter-domain handoffs, however, authentication latency is critical to the application QoS.

Cross-domain-related Protocols

There are two protocols: Kerberos that supports the cross-domain authentication and NS that can be effectively extended to do so. We will use the two protocols to comparatively evaluate the throughout of our protocol via simulation. The following are the descriptions TGSs is assumed to be secure; a secret key of each TGS is shared to identify itself. In addition to the secure link, the AS has security association with its TGS. The remote TGT issued earlier can be reused to get TGTs in the current domain within a given period of time. However, each time the mobile user moves into a foreign domain, he/she needs to get a remote TGT again by contacting its home TGS.

The NS protocol on which Kerberos is based is not intended to operate over crossorganization boundaries. However, it can support cross-domain authentication with minor modifications, which we call a modified NS protocol (MNS). At first, the original protocol operates, in principle, as can be seen in Figure 4.3. The initiator A and its correspondent B share secret keys AK and BK with the AS, respectively. In the beginning, A obtains two copies of a pair-wise key encrypted with BK and AK by the AS, respectively, during their communication. Then, A sends B the BK-encrypted pair-wise key along with SK-encrypted AN. AN will be returned in the next message in order for A to ensure that B with which A is communicating is legitimate. B also adds BN to the message encrypted by SK, and verifies the decremented BN that A sends eventually; those exchanged nonces may be used for key generation for need. We can view A as STA, and B and AS as foreign and home ASs, respectively. When the foreign AS requires a set of pair-wise keys, the home AS generates and sends a set of multiple different keys. Once receiving them, the foreign AS has no need for contacting the home AS, which may lead message exchanges to be reduced into the 3-way handshake.

Design Requirements

The IEEE 802.11i authentication suggests several requirements that must be preserved to secure WLANs.

• Requirement 1: The STA and AS must be able to authenticate each other. Since the STA establishes a wireless link to the AS via anonymous APs, it should be able to identify the AS, so should the AS.

• Requirement 2: A successful mutual authentication leads to the derivation of a fresh key for the AS and STA. After the successful mutual authentication, a 256-bit key (i.e. PMK) is generated by the AS and STA, and is eventually used by the STA and AP. This key must not be reused, and becomes obsolete whenever the STA binds with a new AP.

• Requirement 3: Mutual authentication should be strong enough to be protected from any unauthorized reception. It is uneasy to demonstrate the safety of the authentication protocol, but there are theoretical approaches for this purpose. For example, formal verification methods based on model checking and theorem proving, modal logic and modular approach are widely used. We will show a logical proof of MAP using BAN logic in Section 4.4.1. In addition to these requirements, we present the following recommendations for the authentication protocol design to help achieve fast handoffs in WLANs.

• Recommendation 1: Minimizing message exchanges during the authentication process helps improve the performance of cross-domain handoffs. We evaluate the effects of the number of message exchanges.

• Recommendation 2: The use of lightweight cryptographic algorithms helps low-power mobile terminals, like personal data assistants, mitigate the performance overhead of computation-intensive cryptographic algorithms.

Based on the above requirements, we will design a protocol supporting cross-domain mobility.

BAN Logic

BAN logic [START_REF] Burrows | A Logic of Authentication[END_REF] is a modal logic developed for authentication protocol analysis. It presents the proof that a simple logic could be used to describe the beliefs of trustworthy communicating parties. It found redundancies or security flaws in authentication protocols in the literature [START_REF] Burrows | A Logic of Authentication[END_REF]. BAN logic reasons that the protocol operates as correctly as expected. It is effective to prove the correctness of the authentication mechanisms with logical reasoning.

We introduce the several constructs and logical postulates in BAN logic that will be used for the proof of MAP. Full details of its rules are given in [START_REF] Burrows | A Logic of Authentication[END_REF]. First, the following are the constructs that we use:

-P believes X: P believes X. In particular, the principal P may act as if X is true. This construct is essential to the logic.

-P sees X: P sees X. Someone has sent a message containing X to P, who can read and repeat X possibly after doing some decryption.

-P said X: P once said X. The principal P at some time sent a message including the statement X. It is unknown when the message was sent, but it is known that P believed X then.

-P controls X: the principal P is an authority on X and should be trusted on this matter, e.g. a server is often trusted to generate encryption keys properly. This may be expressed by the assumption that the principals believe that the server has jurisdiction over statements about the generated keys.

fresh(X): the formula X is fresh, i.e. X has not been sent in a message at any time before the current run of the protocol. This is usually true for nonces that is randomly generated for use only once.

-P K ←→ Q: P and Q may use the shared key K to communicate. It is never disclosed by any principal except for P and Q.

-P X ⇐⇒ Q: the formula X is a secret known only to P and Q, and possibly to principals trusted by them. Only P and Q may use X to prove their identities to one another.

-{X} K : this represents the formula X encrypted under the key K.

-< X > Y : this represents X combined with the formula Y; it is intended that Y be a secret and that its presence prove the identity of whoever utters < X > Y .

Then, we use the following logical postulates in proof.

• The message-meaning rules are applied to the interpretation of messages for shared keys P believes Q K ←→ P, P sees {X} K P believes Q said X and for shared secrets, P believes Q Y ⇐⇒ P, P sees < X > Y P believes Q said X .

• The nonce-verification rule represents the check that a message is recent and that the sender still believes in:

P believes f resh(X), P believes Q said X P believes Q believes X .

• The jurisdiction rule states that if P believes that Q has jurisdiction over X then P trusts Q on the truth of X:

P believes Q controls X, P believes Q believes X P believes X .

In addition, the HMAC (Hash Message Authentication Code) represented as MAC(m, K),

where m and K denote a message and a pair-wise secret key, respectively, is used to verify whether or not the verifiee possesses the same K as the verifier. In other words, only if the generated codes are different, the applied Ks are different. Therefore, MAC(m, K) is interpreted as a unit of the secret < X > Y .

MAP

In this section, we describe an authentication architecture that extends the AAA architecture to SCR communications, and design MAP. The description of MAP includes the definition of keys and messages, message exchanges, and detailed operations in each functional module.

Architecture

Authentication operations work basically with three entities: STA, AS and AUTH. An STA represents the end user with a WLAN-interface-equipped device. An AS verifies the STA's authenticity and provides each key to secure their wireless link. An AUTH relays authentication traffic between the STA and AS. In addition to dealing with these entities, our protocol solves the cross-domain authentication problem by introducing so-called security context routers (SCRs). An SCR is usually placed between multiple AUTHs and an AS.

The SCR is logically distinct from the AS in terms of enforcing authentication policy, although both may reside on the same physical machine or the SCR can be integrated into the AS. The SCR functions as follows. After receiving a security context * issued by MAP on the AS, it can perform re-authentication on behalf of the AS. The SCRs are distributed in each domain so that they can reduce authentication latency while the STA roams around the domain. It is assumed that in case of the communication of inter-administration domains they have a security association agreement on roaming and are securely connected to one another by sharing inter-domain keys. This combination is adaptable to the security architecture of the IEEE 802.11i authentication and Wi-Fi Protected Access 2 (WPA2) [START_REF]Wi-fi alliance[END_REF].

The protocol describing how messages are exchanged between the SCRs is presented in Chapter 5. In this chapter, we will give a rough idea of how to exchange messages between SCRs shortly.

Communication between SCRs

The SCRs communicate with each other, based on a peer-to-peer manner. There are two ways of transferring security context among the SCRs involved. In case of no security context cached in an SCR with which an STA has just associated, the targeted SCR fetches security context from the original SCR with which the STA associated previously; reactive transfer introduces the latency of fetching security context. On the other hand, the original SCR may somehow forward the targeted SCR(s) security context before the STA is handed off; proactive transfer emphasizes the availability of the context ahead of time. On the other hand, estimation of the STA's direction and management of security context can be emphasized, which is referred to as predictive forwarding of security context. Their combination yields a tradeoff between storage overhead and latency performance. Elaboration on such issue is part of our future work.

Authentication

The MAP's authentication relies on message authentication code (MAC) algorithms [START_REF] Krawczyk | HMAC: Keyed-Hashing for Message Authentication[END_REF].

The MAC values rely on shared symmetric keys, the management of which is uneasy to scale in that two communication parties must somehow exchange the key in a secure way, compared to that of asymmetric-key pairs. However, on the other hand, signing and verifying public keys are very time-consuming; the MAC values are preferred to digital signatures because the MAC computation is two to three orders of magnitude faster. There is a tradeoff between scalability and CPU usage; we chose cost efficiency since it matches our design goal.

Defined Keys

We define three types of keys for different purposes: primary key (PK), domain key (DK)

and temporary key (TK). PK is a long-term symmetric key which may be periodically updated and deployed, e.g. online subscription to a service provider or off-line set-up with a purchased card. PK is assumed to have guaranteed protection against disclosure for a sufficiently long period of time. DK is a quasi-primary key in a (sub)domain, which

Defined Messages

We define six types of messages exchanged, with the server, SC, authenticator and client modules interacting with each other during initial and re-authentication in MAP. The first four messages are used during the initial authentication and the last two are used during re-authentication.

• Auth-req message, sent by the client module in the STA, triggers a negotiation on authentication and key agreement from scratch.

• Auth-chal message, sent by the server module, as a return message, is used for the purpose of challenging the STA, with an encrypted code used for verifying the AS's authenticity to the STA.

• Chal-res message, sent by the client module, as a response message, contains a nonce-response encrypted code so that the AS verifies the STA's authenticity.

• Auth-res message, sent by the server module, is a reply to a challenge-response message.

• Reauth-req message is sent by the client module in the authenticated STA. The SCR captures this message and verifies if the authentication code is legitimate.

• Reauth-res message is a reply to the reauthentication-request message including the authentication result.

Message Exchanges

The following is an example of exchanging messages in case of a successful authentication.

Only authentication-related information is highlighted in the messages.

If the STA is authenticated successfully, the SCR adds another nonce for the next challenge in the message. The STA can authenticate the SCR by verifying if the nonce is identical of the one that it sent previously.

In the subsequent section, we describe in details how MACs and hierarchical keys are computed and used in each module.

MAP Server Module

The server module handles two types of incoming messages (i.e. auth-req and chal-res)

that are related only to authentication from scratch. The following is the description of the pseudo code of the server module.

var: sn 1..n , cn 1..n := 0; %Server and client nonce queues are initialized.

for all i: auth-req of Id i in buffer do sn i =refresh(sn i ); %A fresh nonce is generated.

send auth-chal: sn i | MAC PK i (Id i , cn ′ , sn i ,"authch"); cn i =cn ′ ;%Client nonce from the message is buffered.

end for for all i: chal-res of Id i in buffer do DK i, j-1 = PRF(PK i , cn i , sn i ); %cn i is obtained from authreq.

if MAC PK i (Id i , cn ′ , sn i ,"authres") && MIC DK i, j-1 verified %cn ′ is obtained from chal-res.

sn i =refresh(sn i );

DK + =H α i (DK i, j-1 )
send auth-res: sn i | cn ′ | DK + ;%DK + is transferred to the authenticator.

make SC i :

implemented, combined with the server module. The following is the description of the pseudo code of the SC module.

for all i: reauth-req of Id i in buffer do AVP l =(Id i , sn i , MAC, DK i, j ) ← l..n AVP; %Select one of AVPs.

if MAC && MIC DK i, j verified do %The integrity of the message is checked.

send reauth-res: cn ′ |sn i |H α i (DK i, j );%DK + is derived by α-time hashing.

end if end for

The SC module first retrieves one of AVPs from the security context corresponding to Id i and then verifies MAC MAC ′ or MIC DK i, j (reauth-req) MIC ′ . If they are matched correctly, it computes DK + and sends the authenticator it along with the exchanged and retrieved nonces. If DK is not allowed to be reused, the AVP is dethroned when it is notified somehow that the STA of Id i de-associates with the current AP. If no more AVP exists, the re-authentication request is forwarded to the AS which will, in turn, handle the request from scratch. Note that the SC module does not possess any PK.

Authenticator

A primary role of this module is to relay incoming messages. It also computes an TK with which the STA and AP establish a secure link after a successful authentication. Authenticator is beyond access to DK; DK + received from the AS/SCR is used to compute TK by calculating a PRF -the key-size varies with cryptographic protocols to be used for securing a wireless link, yet it is either 256 or 512 bits. TK binds with media access control addresses of the STA and AP; de-association revokes TK and a new TK must be recomputed.

MAP Client Module

The client module incurs an authentication request message (e.g. auth-req or reauth-req)

when the STA (re)associates with an AP. It also handles incoming messages (i.e. auth-chal, auth-res and reauth-res) and outgoing messages (i.e. chal-res).

var: secret := 0, cn;%cn is a client nonce.

Security Considerations

In this section, first, using BAN logic, we show the logical proof that MAP performs its authentication mechanism correctly as it is expected, and then examine security threats to our protocol.

Protocol Analysis

The analysis procedure works as follows. First, we translate the original protocol into the idealized one and then make assumptions about the initial state. Finally, we make logical formulas as assertions and apply the logical postulates to the assumptions and assertions to arrive at conclusions.

Translation; we extract the encrypted forms of messages from MAP communications as follows:

M1. B → A: < N a , N b > PK M2. A → B: < N b , N a > PK M3. B → A: {N b ′ , N a ′ } DK M4. A → B: < N b ′ , A DK ←→ B > PK M5. B → A: {N b ′′ , N a ′′ } K ab ′
We have STA and SCR, referred to as A and B, respectively -the functionality of AS and AUTH is integrated into SCR for simplicity; DK + is identical of DK. We also omit communication in clear-text. There is a slight difference by representing (N a ⊕ N b ) as (N a , N b ), which is acceptable since this means that N a and N b were uttered at the same time and their XOR-ed value is straightforwardly obtained.

For authentication, each party verifies the MAC which requires the nonces generated by itself and the other. That is, the correct MAC can only be generated with the fresh nonces from the two. Thus, authentication between A and B might be deemed complete if each of the two believes that the other has recently sent the nonce, and proving sound mutual for re-authentication.

Making assumptions; we then write the following assumptions:

(1) Assumptions (1) and ( 2) are made from the fact that A and B initially share a secret, PK.

A believes A PK ⇐⇒ B, (2) B believes A PK ⇐⇒ B, (3)
Assumptions (3), (4), ( 5) and ( 6) are derived from the fact that only A and B can generate a shared key only if the sound authentication is achieved. Assumptions (7) to (12) state that A and B believe that the nonces generated by themselves are fresh; freshness of nonces holds by verification of MAC and MIC associated with the nonces. The nonces, N b ′ and N b ′′ , also play a role of secrets since they are transferred with proper encryption. Thus, A can believe that B has generated the nonces that was not used in the past,which leads to Assumptions ( 13) and ( 14), and also [START_REF] Akyildiz | A dynamic location management scheme for nextgeneration multitier pcs systems[END_REF] and ( 16), indicating that A trusts B to generate the secret.

Possible Attacks

Key recovery attack: This relies on finding the key K itself from a number of message-MAC pairs. Ideally, any attack allowing key recovery requires about 2 k operations where k is the length of K. The adversary tries all possible keys with a small number of message-MAC pairs available. Choosing a sufficiently long key is a simple way to thwart a key search. Another possible attack is to choose an arbitrary fraudulent message and append a randomly-chosen MAC value. Ideally, the probability that this MAC value is correct is equal to 1/2 m , where m is the number of bits in the MAC value. Repeated trials can increase the corresponding expected value, but a good implementation will be alert to repeated MAC verification errors.

Forgery attack: This attack relies on prediction of MAC K (x) for a message x without initial knowledge of K. For an input pair (x, x ′ ) with MAC K (x)=g(H) and MAC K (x ′ )=g(H ′ ),

where g denotes the output transformation and H is a chaining variable, a collision occurs if

MAC K (x) = MAC K (x ′
). Its feasibility depends on an n-bit chaining variable and the MAC result. Given g that is a permutation, a collision can be found using an expected number of √ 2 • 2 n/2 known text-MAC pairs of at least two divided blocks each. A simple way to counter this attack is to ensure that each sequence number at the beginning of every message is used only once within the lifetime of the key.

Impersonating attack: Note that the AUTH, SCR and AS maintain a security association with each other. Therefore, neither of them can be used to impersonate the other.

Instead, this attack occurs between the STA and AUTH, which causes an authentication failure or misconduct of the principals. Oracle-based impersonating attacks are that the attacker exploits one of principals as an oracle to obtain cryptographic messages in a session since it has no knowledge of K. The attacker applies the obtained messages to the other principal party in another session. For example, it runs a session with an AUTH to obtain a MAC value, impersonating a legitimate STA. It runs another session with an STA and exploits the MAC value on the STA, impersonating the legitimate AUTH. This attack can be countered by exchanging nonce with each other and using a sequence counter.

Performance Evaluation

We evaluate the efficiency of MAP via experimentation and simulation, contrasting it with other protocols. We first describe simulation methodology and model and then analyze the MAP's performance benefits via the simulation results and in comparison with other protocols. Finally, we discuss the storage overhead caused by security-context transfer.

Simulation Methodology

The probe phase, discovering the next AP in WLAN handoffs, takes a large latency (ranging from 50ms to 350ms), depending on different vendors [START_REF] Mishra | An Empirical Analysis of the IEEE 802.11 MAC Layer Handoff Process[END_REF]. Even if the recent effort in [START_REF] Shin | Improving the Latency of 802.11 hand-offs using Neighbor Graphs[END_REF] to reduce latency by 84%, the large variance is an obstacle to highlight the effectiveness of our protocol on a real testbed. We therefore use Matlab-based simulation, relying on experimental data. We assume that network traffic is stable with small variations, e.g.

the latency of establishing a (re)association with an AP including the probe phase is 30ms with 3% jitter, and the round-trip time (RTT) between two communicating servers across a domain is about 20ms with 4% jitter. In addition, the RTT between the AP and SCR/AS is less than 3ms. We use these values throughout the simulation. In cryptographic computations, we conducted an experiment using three machines: Linux v.

The Simulation Model

Handoff Pattern

The handoff pattern for STAs is basically random; the STAs cross the boundary after hopping a random number of times. Random pattern is sufficient to evaluate the overall efficiency performance. Nevertheless, to notice the comparative effectiveness of our protocol, we additionally set a regular handoff pattern; after association in the home domain, STAs hop three times and then cross a domain boundary. In a visited domain, every five hops

SCR Configuration

Whether or not the "visitor" can use storage resources in a domain affects the performance of its handoffs. There can be three system configurations according to the storage availability in the SCR of the visited domain. First, if only relaying security context is allowed, the authentication process takes place in the AS/SCR of the home domain. The SCR in the visited domain serves as a relay agent. Second, if caching security context is allowed, the foreign SCR serves as a proxy authentication server. In this case, security context is transferred and stored in the visited domain, which enables avoiding contact with the home server. Third, if pre-caching security context is allowed somehow, i.e. security context is transferred to the foreign SCR before the STA arrives, then the latency of fetching security context from the home server/SCR can be eliminated. We will evaluate the caching effect via simulation.

The Simulation Results

MAP performs an optimized re-authentication procedure based on the security context generated after the initial authentication. It allows one to (1) consolidate the re-authentication procedure (with two-message exchanges, the mutual authentication is completed) and ( 2)

avoiding contact with the home server from the visited domain. authentication processes in the cases of caching and pre-caching security context, respectively, take less than 36ms.

We evaluated the increase in storage availability via the number of authentication requests with a random handoff pattern. Figure 4.9 shows that the higher inter-domain handoff frequency the home SCR has, the higher its storage availability. The x-axis is the ratio of authentication request queries in inter-domain handoffs to the total number of queries, and the y-axis is the ratio of the network traffic in the foreign SCRs. Let AQ r denote the foreign server's overhead and AQ l denote the home server's overhead. Then, the ratio of the gain in storage availability with MAP to the overall overhead is expressed as, 1 -AQ l /(AQ l + AQ r ) which grows as the frequency of the inter-domain handoffs increases. PNS and TLS. We chose one-way hash functions (i.e. MD5 [START_REF] Ronald | The MD5 Message-Digest Algorithm[END_REF], SHA [START_REF]Secure Hash Standard[END_REF]) and block ciphers (i.e. AES [START_REF]Advanced Encryption Standard[END_REF]) for symmetric-key protocols, and RSA [START_REF] Kaliski | PKCS #1 RSA Encryption Version 1[END_REF] 1024-bit modulus for the public-key protocols. The symmetric-key protocols are shown to be two orders of magnitude faster thanks to the inherent advantage over modulo operations. MAP is faster than the MNS and Kerberos protocols, respectively, by 12.6% and 21.5% CPU usage gains. This is a considerable impact on the performance gain in view of millions of runs for authentication in a single server.

As shown in

Comparison with Other Protocols

Regarding the number of message exchanges, MAP achieves the cross-domain authentication only with 2-way handshake, the cost of which is minimal, compared to MNS and Kerberos requiring 3-way and 4-way handshakes, respectively. This contributes to the further enhancement of latency performance.

Related Work

There have been several studies on how to achieve fast handoffs and enhance the performance of authentication mechanisms, including WLAN protocols.

Michra et al. [START_REF] Mishra | Context Caching using Neighbor Graphs for Fast Handoffs in a Wireless Network[END_REF][START_REF] Mishra | Pro-active Key Distribution using Neighbor Graphs[END_REF] presented a keys distributing method by means of proactive context caching. The idea of proactive caching is for an AP to broadcast its cached context to its neighbor APs in advance by using neighbor graphs and IAPP. However, this method is limited to intra-domain handoffs since APs are required to be functionally identical. Pack et al. [START_REF] Pack | Pre-Authenticated Fast Handoff in a Public Wireless LAN based on IEEE 802.1x Model[END_REF] presented a pre-authentication method that skips the IEEE 802.1X authentication phase by distributing the key to a certain number of selected APs and computing the likelihood based on the analysis of past network behavior. Bargh et al. [19] presented the applicability of the pre-authentication method for inter-domain handoffs. However, a pre-authentication method creates a higher risk of compromising security.

Wong et al. [START_REF] Wong | Mutual Authentication and Key Exchange for Low Power Wireless Communications[END_REF] proposed a hybrid protocol based on a certificate containing a symmetric key signed with a public key which is suitable for wireless communications. An asymmetric method for wireless communications presented in [START_REF] Jakobsson | Mutual Authentication for Low-Power Mobile Devices[END_REF] uses Diffie-Hellman key exchange combined with Schnorr signatures. In addition, there are several legacy authentication protocols [START_REF] Burrows | A Logic of Authentication[END_REF][START_REF] Dierks | Transport Layer Security protocol version 1.0[END_REF][START_REF] Otway | Efficient and timely mutual authentication[END_REF][START_REF] Satyanarayanan | Integrating security in a large distributed system[END_REF][START_REF] Thomas | A Lesson on Authentication Protocol Design[END_REF][START_REF] Zhang | Using SMV for cryptographic protocol analysis: a case study[END_REF] for the general purpose in the literature.

There are several approaches to analyzing the security of authentication protocols. One is the formal methods that model and verify the protocol using specification languages and verification tools [START_REF] Meadows | Formal Verification of Cryptographic Protocols: A Survey[END_REF]. It consists of model checking and theorem-proving methods.

Application examples [START_REF] Heather | Towards automatic verification of authentication protocols on an unbounded network[END_REF][START_REF] Lowe | Breaking and fixing the Needham-Schroeder public-key protocol using FDR[END_REF][START_REF] Maggi | Using spin to verify security properties of cryptographic protocols[END_REF][START_REF] Mitchell | Automated analysis of cryptographic protocols using murφ[END_REF]] demonstrated the feasibility of formally verifying the authentication protocols with general-purpose verification tools. Also proposed in [START_REF] Aiello | Efficient, DoS-Resistant, Secure Key Exchange for Internet Protocols[END_REF][START_REF] Bellare | A Modular Approach to the Design and Analysis of Authentication and Key Exchange Protocols[END_REF][START_REF] Wong | Efficient and Mutually Authenticated Key Exchange for Low Power Computing Devices[END_REF] are modular approaches aiming to establish a sound formalization and a security analysis for the authentication problem.

Conclusions

The cross-domain authentication requires retrieval of security context from the server of the previously-visited or home domain. Contacting a remote server may increase authentication latency significantly. the longer the end-to-end distance, the larger the latency reduction. The longer the end-to-end distance, the larger the latency reduction. If security context is allowed to be pre-cached/transferred before the mobile device arrives, latency can be reduced significantly. In this chapter we designed and evaluated a mobility-adjusted authentication protocol, MAP, by leveraging symmetric-key cryptography for cross-domain authentication and key generation. MAP can be configured to make tradeoffs between performance and storage usage. MAP introduces three concepts to the cross-domain authenti-cation: (1) a re-authentication mechanism based on a 2-way handshake; (2) the temporarykey generation of the IEEE 802.11i authentication; and (3) security context eliminating the need to contact a remote server. MAP performs best in cases of long end-to-end domain distances and high cross-domain authentication traffic.

Chapter 5

Security Context Router

Introduction

Rapidly converging inter-wireless technologies enable mobile users carrying multimediaaccess devices to roam seamlessly around heterogeneous networks. One of the key accessmedia-independent handoff services is the cross-domain authentication that consists of security protocols and security-context management. Despite the fundamental importance of security context management, how to achieve efficient transfer, consistency, and low storage overhead of the security context is not well understood.

Numerous studies of location tracking and resource allocation for QoS-sensitive applications have been done on intra-domain handoffs in cellular networks. Tracking a mobile's trajectory based on a hierarchical mobility model (i.e. accounting for local and global mobility) improves the accuracy of location prediction [START_REF] Liu | Mobility modeling, location tracking, and trajectory prediction in wireless atm networks[END_REF]. Alternatively, one may compute the handoff probability based on an aggregate history of handoffs observed in each cell [START_REF] Choi | Predictive and adaptive bandwidth reservation for hand-offs in QoS-sensitive cellular networks[END_REF]. In contrast, only limited work has been done on cross-domain handoffs; whether or not to comply with the same administrative/operational policy over the entire network distinguishes generic multi-tier boundary handoffs. A boundary location area that covers a region of network boundary and a boundary location register that is a database cache for the handoff information of mobile users, are created for location update and paging purposes between two tiers [START_REF] Akyildiz | A dynamic location management scheme for nextgeneration multitier pcs systems[END_REF]. This method requires the boundary location registers to be deployed and maintained in cooperation with adjacent end-systems.

Securing a handoff takes a significant amount of time, especially due to its requirement of contacting the remote authentication server or re-establishing a connection from scratch.

In Chapter 4, we presented a solution in which the authentication server in the home domain creates a security context after successfully authenticating a mobile user, then transfers it to the mobile's target access network so as to eliminate the need for contacting the home server or re-establishing the connection. Security context for securing handoffs needs to be "propagated" as the mobile user visits different domains.

We propose a security context router (SCR) that controls (part of) each domain. A group of collaborating SCRs form an overlay network and operate in a manner that is geographically independent of access networks. Given an authentication request, the SCR in control of the domain which a mobile node is visiting, contacts the original SCR of the domain in which the mobile resided previously, and fetches the corresponding security context; this is the reactive transfer of the security context. However, it incurs an unpredictably long delay. One may make the security context available in the targeted domain before the mobile arrives; this is called the proactive caching of the security context. If the original SCR estimates the mobile will cross the domain boundary, it transfers the replicas of security context to its neighboring domains in the SCR's vicinity. However, care needs to be taken for replication in terms of storage overhead, consistency, and scalability.

Our goal is to provide a method for efficient, predictive forwarding of the security context via an overlay network. Our approach differs from most existing prediction approaches in that it is free of geographical dependency, while the others rely on geographical dependency on wireless/wired access networks. Two key features of SCR are approximate pattern matching and statistical estimation. First, as the mobile experiences handoffs, Timehistory Vectors of Angles (TVAs) are constructed by capturing the positions of access nodes (including access points or base stations) with which the mobile has been associated, calculating the variations of angles, and observing the fact that a node's mobility reflects its directional pattern. Second, after classifying TVAs into a pattern, we analyze associations of the pattern with target SCRs. Such associations assume a distribution, so that we can determine a confidence interval in forwarding the security context to the SCRs that fall within such an interval. These two features enable accurate prediction of forwarding and significant reduction in storage overhead.

The remainder of this chapter is structured as follows. Section 5.2 describes the overall system on which SCRs are built. We first specify the attributes of security context, and introduce an SCR. We then describe the access networks in which mobiles move around and the overlay network formed by properly linking SCRs. Section 5.3 describes a mobility model that captures direction-oriented movements. In Section 5.4, we design the SCR and elaborate on the two key features of SCR's predictive forwarding. Garbage collection and connectivity functions are also described, and the associated storage overhead is analyzed. Section 5.5 evaluates the SCR via simulation and numerical analysis, highlighting its performance improvements. Finally, we discuss the related work in Section 5.6 and conclude this chapter in Section 5.7.

System Description

This section describes the system that consists of a security context, SCRs, and multi-tier & overlay networks. When describing the system under study, we will use subscripts to identify objects; e.g. given o s,i , i represents o's ID, and s represents the ID of a super-object to which o belongs.

Security Context

The contents of security context vary with the underlying protocol; e.g. the security context defined and used in MAP includes, authentication value pairs, mobile's ID, and other security information. The proactive keys defined in [START_REF] Mishra | Pro-active Key Distribution using Neighbor Graphs[END_REF] can also be part of the security context, but the underlying protocol deals only with intra-domain handoffs. In most cases, a security context is derived from credential, and is distinct from it, since the security context is a variable part of credential, e.g. excluding a long-term key and detailed private information.

Multiple replicas of a security context may be sent out to allow an MN to seamlessly hand off across all areas of access networks. Also included are other parameters for managing a security context, such as validity of lifetime for the context, validity of lifetime for each replica, and a removal-indicating bit for an obsolete replica (e.g. 1 denotes obsolete). Efficient management of the security context for consistency is required. Given below is a brief description of the SCR's roles in security-context management.

The Security Context Router

There are several roles for the SCR to play. First, it has to transfer a security context as an MN roams around: the MN's security context is transferred upon request (reactive transfer), or the replica(s) of its security context is(are) forwarded ahead of its arrival at a domain based on the estimation of its future direction (predictive forwarding). Second, it must reduce the storage requirement by deleting obsolete replicas of security context (garbage collection). Third, each SCR has two interfaces: one for linking itself to other SCRs in a peer-to-peer manner, and the other for capturing its movement from the access nodes in a client/server manner. Multiple SCRs form an overlay network via their interfaces. Last, it should allow a plug-in authentication protocol, such as MAP and Kerberos [START_REF] Neuman | The kerberos network authentication service (V5)[END_REF], to run on a functional module whose architecture will be described in Section 5.4.

Multi-tier and Overlay Networks

For a wireless network built with heterogeneous technologies, one must make the best of the characteristics (e.g. coverage or cell and bandwidth) of each underlying technology. Such a network is an assembly of macro-, micro-, and pico-cell-based multi-tiers. A wired backbone and a number of base stations make up a cellular network. Each base station controls a cell, and a group of base stations are managed by a mobile switching center for circuit switching, or serving GPRS supporting node for packet switching, and an HLR/VLR for the authentication of MNs. When associated with a base station belonging to another mobile switching center, an MN registers with the VLR connected to the center. A WLAN is composed of access points and a back-end authentication server. A number of authentication clients under the control of each access point and a single home server make up an authentication system. When the MN is associated with the access point that another authentication server controls, its authentication request is dealt with in cooperation with the home server. A pico-net system is akin to a WLAN system -a number of slaves and an elected master connected to the back-end authentication server. SCRs are connected to VLRs/HLRs and the back-end authentication servers, and access nodes are regarded as base stations, access points, and slaves. Network I differs from network J in their operational policies. Networks I and M maintain themselves independently even if they are under the same administrator. Networks L and O are composed of tiny cells that form a private area network. Selecting which network to use depends on the availability of bandwidth along with a cost-effective policy. We use the term "domain" as an administration-and operation-independent area, which allows for clustering heterogeneous networks -shuffle and categorize them according to their application maintenance -and constructs a network with such clusters. Each network is basically regarded as a single domain, yet it can be divided into several disjoint (sub)domains -in Figure 5.1, N is divided into domains P and Q. Adjacent cells in the domain boundary do not need any lower-level agreement of association to understand protocols; i.e. a neighbor's ID, geographical topology/location, and protocol compatibility are unnecessary to be maintained. Instead, we introduce a boundary neighbor register that consists of a set of entities, allowing for the construction of a logical neighborhood. This will be detailed in Section 5.4.1.

An SCR represents a domain. A link between SCRs is introduced if needed; e.g. given scr i in which an MN resided previously and scr j to which the MN has just been bound, scr i transfers its security context to scr j upon request, and for the security-context transfer, there must be a secure connection between scr i and scr j . Such connections make up an overlay network, an undirected graph G = (V, E), where V={scr 1 , . . ., scr n } and E is a set of edges e i, j =(scr i , scr j ). Domain I that scr i controls is a set of access nodes, {an i,1 , ..., an i,n }. The above overlay network is independent of geographical adjacency between access networks; e.g. in Figure 5.1, network K is adjacent to network L, while scr k and scr l

System Model

We model a network as a grid, and build a mobility model based on the observation that the direction of a mobile's movement is generally not ad hoc, as advocated by the global mobility model in [START_REF] Liu | Mobility modeling, location tracking, and trajectory prediction in wireless atm networks[END_REF].

Network Model

A group of access nodes are assumed to be distributed uniformly, and each group belongs to an SCR. As shown in Figure 5.2, an integrated network is represented as a grid of access nodes in which an MN can move and be associated with one of 8 surrounding access points.

Given MN A bound to scr n , observing the direction of its movement towards Southeast, it is most likely to move into the domain under scr l 's control, so that A's security context will likely be forwarded to scr l . On the other hand, given MN B bound to scr i , observing the direction of its movement towards North or Northwest, it is unlikely to move to the domain under scr k 's control. Therefore, scr k will eventually be excluded from the set of receivers of B's replicas.

Mobility Model

Our mobility model is based on the fact that most MNs' movement directions are best characterized by TVAs, constructed by computing time-varying angles. MNs may move from their current location in any direction. The next movement direction is determined with current location l of (x j , y j ), a distribution f , and an anchor ω.

Two types of anchors are defined as a directional attitude.

• Absolute anchor: an MN's destination is known from the beginning, and the primary direction in which it intends to arrive does not change over time as shown in . The MN will eventually reach the destination.

• Relative anchor: the mobile's intended direction is calculated with current and previous positions; i.e. it is determined by the MN's past path as shown in . Given previous position (x i , y i ), we derive the relative anchor by computing tan -1 y j -y i x j -x i , while the absolute anchor is given initially. Provided that the directions of an MN's movement are observed and the probability of the MN taking a direction is relatively greater than the other directions, we generate a discrete distribution, f D , with a random variable X of directions. Each direction is labeled with an index of the quantized angles

x S = {k : ∀ θ, 2π n (k -1) ≤ θ< 2π n k, k ≤ n ∈ Z}. (5.1)
By simplifying and categorizing the area, we compute f D as follows. For the directions in the angle of (x j , x k ], it is set to the probability p = ( j,k] f D .

(5.2) Within ( j, k], the MN's movement is pointed toward a most purposeful direction, which is set to be the conditional probability

q = f D ( j + k -j 2 )|p. (5.3)
Subsequently, directions that are most unlikely to be taken are opposite to the intended directions; i.e. the angles of ( j ′ , k ′ ] are represented as the interval ( j+ n 2 mod n, k+ n 2 mod n], which is set to be the conditional probability

r = ( j ′ , k ′ ] f D | ≤x f D -p.
(5.4)

The above derivation of the distribution is based on n = 8, but it can easily be generalized to the case of n > 8. As p, q → 1, r → 0, and kj → 0, the variance gets minimized, so that the MN's movement may appear unidirectional. As p = 1, q, r = 0, and kj ≈ n/2, f D becomes uniformly-distributed over the interval [-π/2, π/2], and in particular, at p = 1/2, so does it for all directions.

The MN's initial velocity is assumed to be a random variable with a normal Gaussian distribution truncated in the range of (0, V max km/h], and its variation draws from a uniform distribution within ∆ v % of the mean velocity E(V).

The TVA is represented as a matrix of R × A, where R is the total number of records, and A the total number of quantized angles such that the MN hands off to one of access nodes. Matrix M is written as

M =                                      α 1,1 α 1,2 • • • α 1,A α 2,1 . . . . . . • • • • • • α r,θ • • • . . . . . . α r,θ =           
1, if the MN has taken the direction 0, otherwise.

The element α r,θ of the matrix indicates if the MN has taken the direction of a quantized angle.

Edit distance

To see (dis)similarities of pattern sequences, one sequence is edited to become the same as the other; i.e. the edit distance to determine the resemblance between two sequences [START_REF] Duda | Pattern Classification[END_REF] is computed as follows. Given an observed sequence

a 1 • • • a m ,
d(a 1 • • • a i , 1) =            1, i = 1 ∞, 1 < i ≤ m. To compute d(a 1 • • • a i , b 1 • • • b j )
, consider each path from (0, 0) to (i, j) as follows:

d(a i , b j ) =                              d(a i-1 , b j-1 ) if a i = b j min                     d(a i-1 , b j-1 ) + C C , d(a i-1 , b j ) + C D , d(a i , b j-1 ) + C I                    
if a i b j .

(

All costs are set to 1 in generic methods [START_REF] Duda | Pattern Classification[END_REF], but we integrate the "degree of matching" into the cost, i.e. the cost increases as the matching proceeds further. Our proposed costs C C , C D , and C I will be defined in the next section.

Pattern Classification

A training set of data is built where we observe the outcome and feature measurements for a set of direction patterns. This data will be used to construct a prediction model for the outcome of new unseen TVAs. There are two simple but powerful prediction meth-where N k (x) is the neighborhood of x defined by the k closest points x i in the training set.

In other words, we find k observations with x i closest to x in input space, and compute the mean of their responses.

To classify the outputs of qualitative data of TVAs, we transform them into numerical labels, which allows for quantitative distinction, by computing

X 1 = log n i=1 I θ (α n-i+1,θ 0)2 n-i , X 2 = log 1 n-1 (I θ -E(I θ )) 2 , (5.11)
where I θ (x) denotes an index of θ satisfying x. In the representation of X 1 , the multiplication of 2 to n power reflects the depth of the vector, which will be detailed when we discuss the cost of edit distance; the edit distances between TVAs are slightly different from those between the transformed ones.

Design of SCR

This section elaborates on the design of an SCR and its functional modules. Based on Figure 5.5 that illustrates the underlying architecture of SCR, we first outline data sets correlated with their access functions, and then delineate the functional modules each of which is self-reliant. Finally, we quantify the storage overhead of replication, and analyze optimization of the overhead.

Data Sets with Access Functions

There are four data sets maintained and accessed via the corresponding access functions according to the intended functionality. • R i , key-associated route table (KRT), is a list of entities each of which consists of the fields of SCR's ID, the corresponding accessible address, and cryptographic key; e.g. scr i looks up the table to find scr j , and encrypts or decrypts exchanged messages with the corresponding key which may be a symmetric or public key depending on the type of secure mechanism to be used. The description is detailed in Chapter 4.

• S i , security context register (SCR), is a set of security contexts. The security context operations include functions to read, add, delete, and update the security context from/to S i . In addition to the security context, its replica is also stored temporarily, and if the replica is used before its validity is expired, then the validity is updated with that of the security context, and the removal-indicating bit is set to 0.

Otherwise, it is set to 1, which signifies the removal of the replica to the garbage-collection module.

• B i , boundary neighbor register (BNR), is a set of triples, {(an i,1 , scr j , an j,l ), (an i,2 , scr j , an j,m ), . . . ,(an i,k , scr j , an j,n )}, each triple of which results from an MN's cross-domain handoff, e.g. from an i,k to an j,n that belongs to scr j . It provides logical conjunctions of access nodes in both sides of the boundary. In addition, the access nodes in the boundary can be extracted by collecting the first value of each triple in B i , i.e. L i ={an i,1 , an i,2 , . . . , an i,k }. Therefore, given an MN associated with an i,k ∈ L i , scr i presumably observes the likelihood of crossing the domain boundary. with an j,n in scr j from an i,k in scr i , messages ǫ ∈ ǫ S and ρ ∈ ρ S essentially contain the fields of IDs A, j, n, i, and k. In some cases, the information on previous associations (e.g.

i and k) may be unavailable, caused by switch-off-and-on, or a loss of connection to the MN. Message ǫ from an j,n is interpreted as one of the following three cases.

C1. The MN has just been associated with an j,n , coming from an i,k in scr i , and its security context transferred from scr i either reactively or proactively is ready for authentication; its security context is found in S j . Either the MN is authenticated or mutual authentication takes place, depending on the security protocol used. After a successful authentication of the MN, scr j informs scr i of such binding, by sending Successful Authentication message, of type 2. Due to the fact that the MN associated with an j,n ∈ L j can return, the predictive forwarding follows. So, scr j sends Predictive Forwarding message, of type 1.

C2. The MN has just been associated with an j,n , but there exists no corresponding security context. So, scr j requests its security context from scr i ; it performs a reactive transfer, sending Reactive Transfer message, of type 3.

C3. The MN has handed off from an j,n to an j,x ∈ L j , which means to scr j that the MN is likely to cross the boundary, so that it performs the predictive forwarding by sending

Predictive Forwarding message, of type 1.

Message ρ from neighboring SCRs is interpreted as one of the following five types.

T1. As a reaction to propagation of the replica corresponding to Cases 1 and 3 of Predictive Forwarding message, scr x adds it to S x ; if there exists an obsolete replica, the most recent one is updated.

T2. As a response to an acknowledgement corresponding to Case 1 of the Successful Authentication message, scr i deletes the corresponding security context from S i . It may be scr i that sends out the removal message, of type 5, for propagated replicas to its neighbors, h(scr i , n) ⊂ H i -{scr j }. If scr j sends the removal message instead, it signals the message to H j . Note that if the MN resided in scr i , this case would not occur, which results in the state of the replicas of its security context in scr j being obsolete. We rely on garbage collection to remove such obsolete replicas.

T3. As a response to the request for the security context corresponding to Case 2 of the Reactive Transfer message, scr i sends the security context to scr j with message type 4, and then deletes it from S i . Meanwhile, it adds this association (an i,k , scr j , an j,n ) to B i .

T4. As a response to the message of type 3, scr j receives and adds the corresponding security context to S j while adding the association (an j,n , scr i , an i,k ) to B j .

T5. The garbage-collection module is executed in case of the removal message propagated.

Reactive Transfer: To fetch the security context, scr j extracts information on scr i from ǫ. If no information on the previous association is found, it performs an n-hop neighbor search. If scr i is requested and finds the security context in S i , it responds to scr j . Both scr i and scr j then add this association to their BNRs. Meanwhile, a 1-hop connection is established if a cryptographic key is exchanged successfully, by updating their KRT.

Predictive Forwarding: scr i propagates as many replicas of security context as the cardinality of the following set:

G(x) = {e 2 : ∀ e = (e 1 , e 2 , e 3 ) ∈ B i , x ≡ e 1 }.
(5.12)

Learning that the MN from an i,k is highly unlikely to be bound to {scr k , . . . , scr l } ⊂ G(m), scr i will exclude the SCRs in such a set, i.e. we minimize the set of SCRs to which the replicas of security context will be forwarded. For this optimization, we utilize approximate pattern matching and statistical estimation.

• Cost of Edit Distance: We here define the cost of edit distance in Eq. (5.6) of Section 5.

3.3. C C is the cost of changing b j in b 1 • • • b n by a i in a 1 • • • a n ,
and is computed as: where α = j n is the rounded-off weight, and increases as j

C C =                    1 + α if a i ≤ b j ± 1, 2 + α if a i ≤ b j ± 2, ∞ otherwise,
→ n. C D is the cost of deleting b j . If b 1 • • • b i is empty, there is no cost. C D =            0 empty, 1 + α otherwise.
C I is the cost of inserting a i at position i, computed as:

C I =                    1 + α if a i ≤ b j ± 1, 2 + α if a i ≤ b j ± 2, ∞ otherwise.
Our gradually-weight-imposed edit distance is different from Liu's [START_REF] Liu | Mobility modeling, location tracking, and trajectory prediction in wireless atm networks[END_REF] in that the weight cost varies with sensitivity to deviations from the beginning to the end of the method allows for differentiation of deviations at the end whereas that in [START_REF] Liu | Mobility modeling, location tracking, and trajectory prediction in wireless atm networks[END_REF] does not. In case of d 5 , our method recognizes similarity better than the generic method.

• Statistical Estimation: As illustrated in Figure 5.6, the estimation procedure begins with recording the TVA of an MN in the matrix form of Eq. (5.5). Using the Chebyshev inequality theorem [START_REF] Papoulis | Probability, Random Variables and Stochastic Processes[END_REF], we define the distribution f S of a random variable X in G(x) with a finite mean µ and a finite variance σ 2 . For any value of dropout rate δ p > 0, we obtain

P(|X -µ|≥ σ δ p ) ≤ δ p . (5.13)
We set σ = 1 for any f S , showing that irrespective of the type of f S , the equation works effectively. It allows the decision-maker to exclude the values of x that are outside (µ -1/ δ p , µ + 1/ δ p ) when the replicas of security context are to be forwarded. If the MN is bound to x ∈ X eventually, G(x) is updated. However, the feedback may change the type of f S ; we will show numerically the impact of such variations in the evaluation section.

Garbage Collection: A number of replicas of security context will be piled up in S x , and the amount of required storage depends on the number of MNs. One may argue that there is a large enough storage to keep all obsolete replicas. However, since there could be many MNs joining and leaving the service, we take a soft-state approach to lowering the storage overhead; for this there are a variety of approaches augmented with functional parameters [START_REF] Ji | A comparison of hard-state and soft-state signaling protocols[END_REF], but we rely on removal of obsolete replicas such that scr x scans S x , selects the replicas with the removal-indicating bit set to 1, and removes the expired ones of them.

A timestamp t s is used in forwarding the replicas to check if they are expired. Given the current time t c , the elapsed time t ct s is checked periodically, and if it is greater than a threshold value δ t , then the corresponding replica is removed from S x . The value of δ t is set large enough to avoid a false positive cache hit; e.g. C • E(S o journT ime), where C is a constant and E is the mean of MNs' sojourn times in a cell.

Connectivity: Given scr i and scr j that are at first logically disconnected from each other, when scr i to which a randomly chosen MN is initially bound finds no neighbor, it contacts the MN's home server to obtain its security context. When the MN moves and is bound to scr j , scr j searches for n-hop neighbors, and if found, scr i responds with its security context. Meanwhile, either scr i or scr j informs the home server of such rebinding of the security context. Otherwise, scr j contacts the home server directly to obtain (the location of) the security context. During the rebinding, scr i and scr j make a logical link between them.

X of t † , in the reverse order of t. Then, we obtain

S t n = |G(x)|N × f (t † 0 ) + (|G(x)|-p)N(F(t † n-1 ) -F(t † 0 )) ≈ (|G(x)|-p)N × F(t † n ).
(5.16)

To reduce the storage overhead, we clean up S x according to δ t . The threshold should be greater than a timestamp in any replica; e.g. C • E(S o journT ime), as discussed earlier.

Since scr x applies δ t to all, it should be large enough to avoid a false positive cache hit.

Therefore, we obtain

S t n = (|G(x)|-p)N × F(δ t ).
(5.17)

On the other hand, in statistical estimation, the decision-maker forwards the replicas to m neighboring SCRs belonging to G(x) that are inside the interval (µ -1/ δ p , µ + 1/ δ p ).

Let q be the conditional probability that some of MNs are bound to some of SCRs in G(x)

assuming that all MNs are bound to the SCRs in G(x). It is thus q = X∈m P(X)|p. Then, we obtain S t n = (mp × q)N × F(δ t ).

(5.18)

Note that there is a tradeoff between the storage overhead and computational complexity.

Evaluation

This section evaluates the key features of predictive forwarding. First, we describe our evaluation methodology, and then analyze the evaluation results. We also numerically analyze the reduction in storage overhead.

Evaluation Methodology

Our performance evaluation is done on a platform that consists of a software implementation of SCRs forming an overlay network, and an emulation of MNs as well as a multi-tier access network. The multi-tier network is realized as a 25 × 25 grid, each point of which represents an access node. The grid is equally partitioned into 25 domains, each of which is under an SCR's control. 150 MNs are distributed uniformly, and their handoffs among access nodes are emulated according to the mobility model described in Section 5.3.2; e.g.

the association of an MN with an access node invokes a trigger message to the corresponding SCR via a TCP port (a reliable link), and an SCR communicates with another via a UDP port (a best-effort link). However, for simplicity, we ignore the impact of packet losses on performance evaluation. In order to synchronize the events taking place between the overlay and access networks, we define tick, a unit of logical time. A handoff takes t ticks, the operation of each module in the SCR consumes 1 tick, and the message exchange between SCRs takes less than t ticks.

Evaluation Results

Effectiveness of Proactive Caching Each handoff invokes a reference to the security context. Figure 5.7 shows the effectiveness of advance forwarding of security context as the completion ratio of BNR increases. This result comes from flooding of security contexts -'turning up' the thresholds in pattern matching and statistical estimation into maximum, so as to highlight the correlation of the BNR completion with possible handoff disruptions.

An MN initially bound to scr 19 enters the domain of scr 13 after making a local handoff.

Due to the unavailability of security context, a reactive transfer, which takes 3 units of time, is activated. However, other MNs contribute to BNR completion gradually over time, and therefore, the MN's move from scr 6 to scr 7 and to scr 13 via scr 8 takes 2 units of time, which is the same as the latency of a local handoff. Even an incomplete BNR makes an impact on proactive caching (for which 40% of BNR completion allowed in the figure).

The more MNs, the quicker the BNR is completed.

Pattern Recognition

The performance of approximate pattern matching varies with a variety of distributions. The regions overlap inevitably, signifying that even two similar patterns may take different directions. There are several misclassifications on both sides of the decision boundary.

a) f D (θ ≤±π, ω abs ) (b) f D (θ ≤±π, ω rel ) (c) f G (σ = 1,θ ≤±π, ω abs ) (d) f G (σ = 1,θ ≤±π, ω rel ) (e) f G (σ = 0.5,θ ≤±π, ω abs ) (f) f G (σ = 0.5,θ ≤±π, ω rel ) (g) f U (θ ≤±π/2) (h) f U (θ ≤±π)
Note that these can be errors on the training data itself -the distance among training data is not exactly equal to that among classified patterns. The linear decision boundary from the least squares fit is stable, while that from the 3-nearest neighbor procedures is irregular, but might be optimal. However, classification errors of the former and the latter are almost the same (equal to 0.083 and 0.087, respectively). Consequently, the two classes are distinguished clearly -each of them has individual mean and variance distributionand prediction by pattern classification is appropriate for our approach to approximate pattern matching. Therefore, provided that a captured TVA of an MN is found matched with any pattern in the training data, we predict the future direction of the MN via the decision boundary.

Numerical Analysis

Impact of soft states on storage overhead The efficiency of the soft-state approach varies with types of the cumulative distribution of replicas, F(δ t ), in Eq. (5.17). Despite the optimal δ t , there is a fundamental limit in reducing the storage overhead, because δ t should be adjusted to be greater than any validity lifetime of the received replicas to avoid falsepositive cache hits. We assess the impact of F on the storage overhead augmented with the parameter from β = 2 to β = 8, introducing a smooth increase to upcoming new replicas over time. In Figure 5.10, with optimal δ t , the smooth increase reduces the storage overhead by more than 90%. However, in case of an abrupt increase (β = 2), only an about 60% reduction is achieved, which is, in turn, difficult to tune δ t to be optimal in the sense that the achievement of most of significant reductions results from more than 90% of .10: The storage overhead while adjusting δ t to be optimal. Given fixed α in a cumulative Gamma distribution F(X), the larger the value of β, the lower and wider the convex shape of the distribution along with the x-axis.

optimally-tuned δ t .

Effectiveness of statistical estimation Statistical estimation helps decrease the storage overhead; the narrower the range of target SCRs to which replicas are forwarded, the lower the storage overhead, minimizing the false negative rate -the rate of misjudging the targets. We evaluate the statistical estimation method with various types of f S : normal Gaussian and Beta (α=6, β=2) distributions assume a highly-integrated density in choosing some SCRs in G(x), while uniform and Beta (α=0.5, β=0.5) distributions assume the equivalent and divided chances, respectively. Furthermore, it is not scalable since a single server must maintain the graph and relocate contexts among access points, which is difficult to extend to inter-domain transfers.

Extensive research has been done on mobility prediction for resource allocation in cellular networks. Liu et al. [START_REF] Liu | Mobility modeling, location tracking, and trajectory prediction in wireless atm networks[END_REF] introduced a hierarchical location prediction algorithm characterized by local and global prediction. In particular, the global prediction algorithm searches for one of user mobility patterns recorded in a user profile that is best matched with the user's actual path using approximate pattern matching, and selects the next cell inside the matched sequence. Its application to cross-domain mobility prediction is difficult, and requires knowledge of the entire multi-tier network topology. Instead of prediction of the next cell, Akyildiz and Wang [START_REF] Akyildiz | The predictive user mobility profile framework for wireless multimedia networks[END_REF] presented a method for predicting a zone towards which mobile nodes will move; this is similar to ours, but differs in that our method offers geographical independence.

Trajectory prediction depends strongly on mobility models. The difference between different mobility models mainly lies in which of random elements, including speed, distance, angle, destination, and travel time, to choose and what probability distributions to use for each choice. We have considered a variety of mobility models discussed in [START_REF] Yoon | Sound mobility models[END_REF].

Conclusions

By forming an overlay network, SCRs offer an attractive alternative to traditional mechanisms for transferring security contexts, especially in terms of flexibility, scalability, and deployability. In order to fully realize the SCR's potential, we must provide methods for transmitting (the replicas of) security context in a manner that is as scalable as the underlying consistency of the security context.

We overcame two challenges: (1) capture mobiles' direction patterns from the multitier access network and transfer security-context replicas via the overlay network, and (2)

derive the efficacy of prediction from a combination of pattern matching and statistical estimation. Traditional prediction mechanisms lack transparent coordination among endsystems built with different technologies. Furthermore, straightforward flooding may at first appear effective, but suffers from its storage overhead. Our solution to predictive forwarding is shown to perform best while reflecting patterns in MNs' movement directions.

It is robust to keep the false negative rate under 5%, even if the associations are distributed uniformly or randomly.

Our main contributions are efficient and scalable context management and algorithms that are effective in all circumstances. With these results, effective collaboration among SCRs is enabled, and predictive forwarding of security contexts via the overlay network can be achieved.

Chapter 6

Conclusions and Recommendations We first investigated a hierarchical authentication scheme, as opposed to the AAA architecture which is based on a client-server scheme. We introduced a deputy agent that plays a key role in enforcing the authentication policy on the basis of the security context that is derived from the mobile user's credentials. Furthermore, transferring the security context via interconnected deputy agents reduces long-distance message exchanges. The evaluation results demonstrated the effectiveness of the decentralized scheme in terms of 123 message traffic overhead.

Second, we proposed a mobility-adjusted authentication protocol, called MAP, that is dedicated to security context router (SCR) collaboration. MAP achieves considerable reduction in authentication latency in message exchanges. In addition, the feature of hierarchical key derivation makes the system more robust against various key comprising attacks. Experimental results and performance evaluation demonstrated that MAP takes full advantage of the concept of security context over other protocols favoring inter-domain authentication.

We then tailored an SCR with collaborative communications to form an overlay network. The key features of the SCR are twofold: it derives, replicates, updates and transfers the security context in a fault-tolerant way such that the existing security context is always available via SCRs, including the home server; predictive forwarding of the security context favors a perfect realization of seamless cross-domain mobility. Statistical estimation was applied to avoid false positive hits. Our numerical analysis and performance evaluation showed that these techniques are very effective and succeed in lowering storage overhead.

Recommendations for Future Research

As described above, our architecture augments the agility of secure cross-domain handoffs to play a key role in seamless mobility. To broaden the applicability of the architecture, nevertheless, there remain several open research problems associated with securing communications among SCRs.

• It is critical to make an architecture not only scalable and lightweight, but attack-tolerant as well. Each SCR is responsible for its domain and they connect to each other dynamically. To securely establish links and communicate with each other requires authenticity and integrity of incoming messages, and privacy of security context. In this thesis, we focused on the security context management, but it is important to develop a mechanism to secure links among SCRs.

• It is impossible to predict the next domain to which a mobile node will move with 100% accuracy. We proposed a novel statistical approach to determine to which SCR the security context will be forwarded. In this thesis, this approach has been applied in coordination with the approximate pattern matching method, but other approaches could be adopted, e.g. the next associations could be determined by verifying membership using the Bloom filter data structure.

Another possible research direction would be to apply our proposed authentication architecture to other applications such as self-organized autonomous mobile devices.

Closing Remarks

Over the past few years, security concerns have been growing as wireless communications become pervasive. An authentication system plays a preliminary role in building a secure communication architecture. Conventional authentication systems based on a client-server scheme show limitations in cross-domain authentication in terms of scalability, efficiency and availability. Our cross-domain authentication architecture provides mobile users with secure seamless handoffs that are a prerequisite for secure multimedia services with acceptable QoS. The architecture is characterized by a decentralized scheme, a scalable authentication protocol, and security context management. We believe that the architecture presented in this thesis provides a good basis for a future secure wireless ubiquitous computing infrastructure.

1. 1

 1 An authentication scheme for the integrated networks . . . . . . . . . . . . 2.1 An example of relevant protocol stacks in the IEEE 802.1X . . . . . . . . . 2.2 EAP message exchange . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 An example of the 4-way handshake . . . . . . . . . . . . . . . . . . . . . 2.4 An example of preauthentication . . . . . . . . . . . . . . . . . . . . . . . 2.5 Proactive key distribution . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.6 An integrated authentication system . . . . . . . . . . . . . . . . . . . . . 2.7 An example of successful SIM-based mobile authentication . . . . . . . . . 3.1 Inter-domain authentication via Diameter over UMTS . . . . . . . . . . . . 3.2 Comparison of authentication latency . . . . . . . . . . . . . . . . . . . . 3.3 Increase in authentication latency as the distance grows . . . . . . . . . . . 3.4 Mobile authentication scenario . . . . . . . . . . . . . . . . . . . . . . . . 3.5 An abstract model for quantifying the cost of message exchanges . . . . . . 3.6 Comparison of cost with various gs as l grows when N = 10 . . . . . . . . 3.7 Evaluation of optimal position for the deputy server (N = 10) . . . . . . . . 4.1 Message exchanges in the IEEE 802.11 and .11i systems . . . . . . . . . .

2. 1

 1 The IEEE 802.11i Standard Security mechanisms for IEEE 802.11 networks were standardized in 2004, including a definition of wired equivalent privacy (WEP) for backward compatibility with the original IEEE 802.11 Standard, 1999. The IEEE 802.11i [12] is an amendment to the IEEE 802.11 standard specifying security mechanisms for wireless networks because WEP was shown to have severe security weaknesses. Its main goal is to provide robust security associations for 802.11 networks. The IEEE 802.11i introduces the concept of a security association into wireless networks and defines security association management protocols. More specifically, the IEEE 802.11i architecture is composed of the IEEE 802.1X for au-13 thentication; a robust secure network (RSN), containing the 4-way handshake, for security associations; and advanced encryption standard (AES)-based counter mode with a cipher block chaining-message authentication code protocol (CCMP) to provide confidentiality, integrity and authentication. The IEEE 802.11i has three main components: mobile nodes (MNs), a set of access points along with authentication clients, and a back-end authentication server. When an MN finds an access point with the highest quality radio channels, a sequence of messages is exchanged: open authentication, IEEE 802.1X authentication, 4-way handshake and optional group-key handshake.2.1.1 The IEEE 802.11 Association Open system authentication exists for backward compatibility with WEP that is part of the IEEE 802.11 Standard ratified in 1999. It has a sequence of 2-message exchanges. The first message asserts identity and requests authentication, and the second message returns the authentication result. WEP uses the stream cipher Rivest Cipher 4 (RC4) for confidentiality. The standard 64-bit WEP uses a 40-bit key to which a 24-bit initialization vector (IV)

Figure 2 .

 2 2 shows an EAP-based message exchange flow. After the

Figure 2 . 1 :

 21 Figure 2.1: An example of relevant protocol stacks in the IEEE 802.1X. E-SP stands for EAP-based security protocols.

Figure 2 . 2 :

 22 Figure 2.2: EAP message exchange

Figure 2 .

 2 Figure 2.3 shows an example of the 4-way handshake message exchanges.

Figure 2 . 3 :

 23 Figure 2.3: An example of the 4-way handshake

Figure 2 . 4 :

 24 Figure 2.4: An example of preauthentication. Current and target APs (i.e. cAP and tAP) are in the boundary of an authentication system. Steps 1 and 2 are assumed to be completed before preauthentication starts.

Figure 2 .

 2 Figure 2.6 depicts an integrated authentication system via the AAA architecture that covers WLANs and cellular networks. If the MN subscribes to a cellular operator, then the AAA associated with the cellular network becomes its home server (AAAH). When the MN intends to have access to a WLAN, the authentication request is forwarded to AAAH;AAAF plays a role of proxy/relay agent in this case.

Figure 2 .

 2 Figure 2.7 shows a signaling diagram for a successful SIM-based authentication while

Figure 2 .

 2 Figure 2.7: An example of successful SIM-based authentication with the MN roaming in a WLAN foreign domain. AAAF and AAAH are RADIUS servers in the WLAN and GPRS, respectively. CAG stands for cellular access gateway that is an interface between IP-based network and GPRS. HLR manages subscribers' credentials.

  M1. Client → Server: AAR (User-Name, Challenge-Request, UMTS-Proxy-Capability)On capturing the request, the AAA client sends an AAR message to the home server via several deputy agents containing the Challenge-Request AV, indicating that a challenge token is required. Any one of the deputy agents may add the UMTS-Proxy-Capability AV to the message, which signifies that it joins the authentication mechanism. M2. Server → Deputy: AAA (User-Name, UMTS-Vectors)

Figure 3 .

 3 Figure 3.1 illustrates a scenario of the AAA-UMTS application during inter-domain handoffs. We implemented the application based on the Diameter NASREQ application [27], including proxy, relay and deputy agents. A Diameter client is installed in the base station, and the deputy agent serves as a Diameter server in the Sophia domain. The MN registers with a Diameter server in the Star-vthd domain. An alternate Diameter server in the Enst domain is necessary for evaluation. When associated with the base station, the MN issues the request via an ad hoc protocol, typing user ID and password. The Diameter client sends a Diameter-transformed request to the home server in the Star-vthd domain.

Figure 3 .

 3 Figure 3.2 shows the impact of a deputy agent on the UMTS network authentication

Figure 3 . 2 :

 32 Figure 3.2: Comparison of authentication latency between Diameter and the combination of Diameter and deputy agent as the number of MNs increases. The latency from sending a request to receiving its result is measured.

Figure 3 . 3 :

 33 Figure 3.3: Increase in authentication latency as the distance grows

Figure 3 .

 3 Figure 3.4 illustrates the message flow of authentication during the cross-domain handoff.

Figure 3 .Figure 3 . 6 :

 336 Figure 3.6: Comparison of cost with various gs as l grows when N = 10

Figure 3

 3 Figure 3.7: Evaluation of optimal position for the deputy server (N = 10)

  Time-sensitive applications, such as Voice over IP (VoIP) or video streaming, are now possible over wireless local area networks (WLANs), such as those based on the IEEE 802.11 Standard [7], thanks to their high bandwidth. WLAN technologies also allow mobile users

( 1 )

 1 MAP reduces cross-domain authentication latency by reducing the number of message exchanges. MAP requires less message exchanges without degrading security or the reauthentication mechanism, reducing authentication latency significantly. (2) MAP replaces the 4-way handshake of the IEEE 802.11i authentication. In coordination with the authenticator within an access point, MAP defines hierarchical key derivation and generates consecutive keys during authentication operations. This leads to optimizing the 802.11i authentication mechanism by removing the need for the 4-way handshake. (3) MAP leverages the concept of security context to mostly avoid remote contact. With the mobile user moving along, its security context is transferred via security context routers (SCRs) we

Figure 4 . 2 :

 42 Figure 4.2: Message exchanges for a remote access grant in Kerberos. This sequence is repeated each time the mobile user is bound to a remote TGS.

Figure 4 . 3 :

 43 Figure 4.3: An example of message exchanges in symmetry-key-based NS protocol. AK and BK are pre-shared between A and AS, and B and AS, respectively. Elements used to authenticate A or AS in messages 1 and 2 are omitted. AN and BN are A's and B's nonces, respectively.

Figure 4 .

 4 Figure 4.4 depicts the MAP architecture. The MAP server module on the AS, which is described in Section 4.3.6, is an end-point authentication protocol that is assumed to securely be connected to the AUTHs via the SCR. The AS used in the architecture is functionally equivalent to the AAA server. The MAP security context module (SC module) in

Figure 4 . 5 :

 45 Figure 4.5: Defined keys hierarchy and boundary. An SCR controls a DK derived from the PK. A subnet uses a DK + hashed from the DK to generate TK that will be used for each association.

  authentication is sufficiently satisfied by deriving the facts: A believes B believes N a and B believes A believes N b for initial authentication and A believes B believesN a ′′ and B believes A believes N b ′

( 5 )( 9 )

 59 A believes A DK ←→ B, (4) B believes A DK ←→ B, A believes A DK ′ ←→ B, (6) B believes A DK ′ ←→ B, (7) A believes f resh(N a ), (8) B believes f resh(N b ), A believes f resh(N a ′ ), (10) B believes f resh(N b ′ ), (11) A believes f resh(N a ′′ ), (12) B believes f resh(N b ′′ ), (13) A believes f resh(N b ′ ), (14) A believes f resh(N b ′′ ), (15) A believes B controls N b ′ , (16) A believes B controls N b ′′ .

Reasoning; we analyze

  the idealized version of MAP by applying the logical postulates presented in Section 4.2.4 to the assumptions.A receives Message M1. The annotation rule yields that A sees < N a , N b > PK holds afterward. With the hypothesis of (1), the message-meaning rule for shared secrets applies and yields A believes B said (N a , N b ). Breaking conjunctions produces A believes B said N a . With the hypothesis of (7), we apply the nonce-verification rule and yield A believes B believes N a . On the other hand, B receives Message M2 and the following result is obtained in the same way as that of Message M1, via the message-meaning and nonce-verification rules with hypotheses (2) and (8), respectively, B sees < N b , N a > PK and B believes A believes N b . This concludes the analysis of Message M2. The analysis of Messages M1 and M2 confirms that MAP performs mutual authentication successfully. A receives Message M3 and the annotation rule yields that A sees {N b ′ , N a ′ } DK holds thereafter. The message-meaning rule for shared keys with the hypothesis of (3) via breaking conjunctions yields: A believes B said N b ′ , and A believes B said N a ′ . Taking the former, with hypotheses (13) and (15), the nonce-verification and jurisdiction rules apply and yield A believes B believes N b ′ , and A believes N b ′ , respectively. Taking the latter, the nonce-verification rule with hypothesis (9) yields A believes B believes N a ′ . This concludes the analysis of Message M3. This message may appear redundant since authentication is completed from Message M1, but it is essential not because it is for authentication, but because it is for transmission of a secret, nonce N b ′ . B receives Message M4 and the annotation rule yields that B sees < N b ′ , A and DK ←→ B > PK holds thereafter. By applying the message-meaning rule for the secrets with (2) via breaking conjunctions, we obtain: B believes A said (N b ′ , A DK ←→ B) and B believes A said N b ′ . The nonce-verification rule with hypothesis (10) yields that B believes A believes N b ′ . On the other hand, A receives Message M5 and the annotation rule yields that B sees {N b ′′ , N a ′′ } DK ′ holds thereafter. By applying the message-meaning rule for the shared keys with hypothesis (6) via breaking conjunctions, we obtain A believes B said N b ′′ and A believes B said N a ′′ . Taking the former, the nonce-verification and jurisdiction rules with (14) and (16) yield A believes B believes N b ′′ , and A believes N b ′′ , respectively. Taking the latter, nonceverification with (11) yields that A believes B believes N a ′′ . The analysis of Messages M4and M5 confirms that MAP also achieves mutual re-authentication.

Figure 4 . 6

 46 Figure 4.6 shows the simulation model we used. Each AS constructs a domain consisting of an SCR and several APs. The SCR and AS may reside on the same machine as mentioned before.

Figure 4 . 6 :

 46 Figure 4.6: The simulation model for inter-domain handoffs. A circle and hexagon indicate an AP's radio coverage range and a domain, respectively. Each SCR controls its domain and is securely connected with its neighbor. An STA initially associates with a.2 and move around in its local domain (from a.5 to a.6 via a.4). It crosses Domain b and finally associates with c.4 in Domain c.

Figure 4

 4 Figure 4.7: Authentication latency variations in different configurations of foreign servers

Figure 4 . 8 Figure 4 . 8 :

 4848 Figure 4.8 shows the results with a random handoff pattern, illustrating the cumulative distributions of authentication latency for three cases supporting SCR. The figure shows the effect of pre-caching and caching security context to achieve more improvements in time efficiency than just relaying security context which is characteristic of the legacy protocols that are unable to generate security context. For example, more than 70% and 80% of

Figure 4 . 9 :

 49 Figure 4.9: System storage availability affected by the inter-domain handoff authentication occurrence ratio. MSE is Mean Squared Error of the above regression function.

Figure 4 .

 4 Figure 4.11 shows the cumulative CPU usage (represented in millisecond) cryptographic primitives of required in ten consecutive times of authentication in symmetry-key-based protocols including MAP, MNS and Kerberos, and public-key-based protocols including

1

  Relative end-to-end domain distance (ms/max(L))

Figure 4 .

 4 Figure 4.10: End-to-end domain distance vs. authentication latency. The distance is scaled down at a rate of the maximum authentication latency (max(L)). SC stands for security context.

Figure 4 . 11 :Figure 4

 4114 Figure 4.11: CPU utilization. Ten consecutive times of authentication. MNS and PNS stand for modified symmetry-key-based and public-key-based Needham Schroeder protocols, respectively. TLS is Transport Layer Security protocol.

  Access networks are distinguished by different cell sizes as shown in Figure 5.1. Network N (e.g. a cellular network) covers a larger area than network M (e.g. a WLAN).

Figure 5 . 1 :

 51 Figure 5.1: Multi-tier access and overlay networks. SCRs, each of which represents a feature domain, form an overlay network. A domain is covered by one or more SCRs.

Figure 5 . 2 :

 52 Figure 5.2: A grid of access networks; a point represents an access node, and MNs A and B may move in one of 8 directions.

( a )Figure 5 . 3 :

 a53 Figure 5.3: Anchor-based determination of directions, where f and ω are the distribution and the anchor, respectively.

Figure 5 .

 5 Figure 5.4 shows the MNs' movement paths of A, B, C, D, E, and F. The anchor is initially set to Northeast, and the speed is set to be constant in order to highlight the effect of movement direction. Each time they are associated with an access node, the next position of the access node is determined by applying their specified distribution, anchor, and restricted angles available. A's path resembles mostly that of B which relies on a Gaussian function. C's path appears straight as driving on a straight highway. D's path results from prohibition of any backward turn as in[START_REF] Akyildiz | The predictive user mobility profile framework for wireless multimedia networks[END_REF][START_REF] Xiao | Mobile speed estimation for tdma-based hierarchical cellular systems[END_REF]. In contrast, E has randomness in all directions, where no regularity is observed. Significant portions of F's path are (close to) linear; i.e. no abrupt turns allow for extracting pattern sequences. We capture and classify such sequences to predict future directions. These examples will be used for performance evaluation.

Figure 5 . 4 :

 54 Figure 5.4: Comparison of a variety of distributions: A is the defined distribution f D (θ ≤ ±π, ω abs ); B and C are Gaussian distributions f G (θ ≤±π, σ = 1,ω abs ) and f G (θ ≤ ±π, σ = 0.5,ω abs ), respectively; D and E are uniform distributions f U (θ ≤±π/2,ω rel ) and f U (θ ≤±π, ω rel ), respectively; F is f G (θ ≤±π, σ = 1,ω rel ), where ω abs and ω = rel denote absolute and relative anchors, respectively.

  and a pattern b 1 • • • b n , we construct an (m + 1)× (n + 1) matrix (d(a 1 • • • a n , b 1 • • • b n )), with (i, j) ranging from (0, 0) to (m, n). If i = 0 or j = 0 meaning that a 1 • • • a i or b 1 • • • b j is an empty sequence, then the matrix values are d(1, 1) = 0, d(1, b 1 • • • b i ) = 0, and

Figure 5 . 5 :

 55 Figure 5.5: SCR architecture. It consists mainly of four data sets, the corresponding access functions, and six functional modules coordinating with interfaces to SCRs and ANs.

Figure 5 . 6 :

 56 Figure 5.6: Estimate of replica forwarding with approximate pattern matching and statistical estimation.

Figure 5 .Figure 5 . 7 :

 557 Figure 5.7: The effectiveness of advance forwarding. Numbers over asterisks indicate IDs of SCRs to which an MN is bound and handing off. The dash line is a best-fit to points that represent a completion rate at each tick, which are omitted for clarity.

(

Figure 5 . 8 :

 58 Figure 5.8: Comparison of pattern recognitions with various distributions. A circled point is represented as a classified pattern, and dotted points around the circled are the ones matched with those at an edit distance. All points are displayed via Eq. (5.11); the range of a group of dotted points corresponds to the edit distance. f D , f G , and f U are discrete, Gaussian, and unform distributions, respectively.

Figure 5 . 9 := 2 α

 592 Figure 5.9: Pattern classification and predictions

Figures 5 .Figure 5 .

 55 Figure5.12: The variance of storage savings gain for a normal Gaussian distribution with δ p = 0.5 and its false negative rate as the number of neighbor SCRs increases.

6. 1 Conclusions

 1 This thesis aims to advance the authentication technology for cross-domain mobility by addressing the requirements of both high-level security and latency-efficiency. The primary contribution consists in the development of a unified, scalable, high-performance authentication architecture that enables mobile nodes to seamlessly cross the domain boundary without compromising high-level security support. The architecture also supports transparency for access networks based on multiple wireless technologies. Our contributions are recapitulated as follows.

  ENC DK + [sn ′ | an | cn ′ ]; %DK + and cn ′ are obtained from the message. TK=PRF(DK + , Addr S T A | Addr AP , an | cn ′ );

	end if
	end if

var: an;%This is an authenticator nonce. if auth-req | auth-chal | chal-res | reauth-req received relay it; end if if auth-res | reauth-res received if success in authentication %This is determined by AS/SCR. an=refresh(an); % A new an is used to generate TK. send auth-res:

  It retains the secret value provided by the AS after completion of the previous successful authentication. Confidentiality of the secret is guaranteed since it is transferred in ciphertext. The secret determines whether the authentication process is conducted from scratch. The α value is matched to that of the AS/SCR.

	send auth-req: Id | cn;
	else %In case of the previous successful authentication
	DK i =PRF(PK, DK i-1 , secret);
	send reauth-req: Id|MAC PK (Id, secret, DK i-1 ,"reauth")|cn|MIC DK i ;
	end if
	end if
	if auth-chal received
	if MAC PK (Id, cn, sn ′ ,"authch") verified %It authenticates AS.
	end if
	end if
	if (re)associated
	cn=Refresh(cn);
	if !secret %In case of authentication from scratch

DK i-1 =PRF(PK, cn, sn ′ ); %sn ′ is obtained from auth-chal cn=Refresh(cn); send chal-res:

Id|cn|MAC PK (Id, cn, sn ′ ,"authres")|MIC DK i-1 ; end if end if if auth-res | reauth-res received DK + =H α (DK i-1 or DK i ); DEC DK + [ENC[sn ′ | an ′ | cn ′ ]]; if cn==cn ′ %It authenticates AS.

secret=sn ′ ;%sn ′ is stored as secret TK = PRF(DK + , Addr S T A | Addr AP , an ′ | cn); %cn is obtained from the previous message.

Table 4 .

 4 1: Throughput of hash/symmetric and asymmetric algorithms (in Megabit per second)

	Alg.\Pow.	iPAQ	MP2	Xeon
	SHA-1	15.8 Mbps	18 Mbps	104.9 Mbps
	SHA-256 3.4 Mbps	9 Mbps	64.0 Mbps
	SHA-512 0.2 Mbps	4.3 Mbps	24.8 Mbps
	MD5	15.8 Mbps	41 Mbps	290.9 Mbps
	AES-128	2.7 Mbps	10 Mbps	80 Mbps
	RSA enc. 15.1 Kbps 138.9 Kbps	625 Kbps
	RSA dec.	0.9 Kbps	4.6 Kbps	21.6 Kbps
	RSA sig.	0.9 Kbps	4.4 Kbps	21.2 Kbps
	RSA ver. 15.1 Kbps 138.9 Kbps	625 Kbps

Table 4 .

 4

[START_REF]Authentication Authorization and Accounting IETF WG[END_REF]

shows the computation throughput of symmetric-key and public-key algorithms, respectively. With these measurement data, we numerically calculate the time to perform each authentication protocol while ignoring the overhead of running applications for simplicity.

  • H i , n-hop neighbor register (HNR), is a set of IDs of SCRs that are linked within the n-hop boundary from scr i . So, H i is used to find neighbors in scr i 's vicinity and to propagate a removal message to neighbors within the n-hop boundary. It is There are two interfaces to ANs and SCRs, represented as buffers ǫ S and ρ S , respectively. Provided that MN A has just been associated

	function h(i, n)
	if n ≤ 1 then
	Return {x:( i, x) ∈ E}
	else
	Return {x: ∀ k ∈ h(i, n -1), (k, x) ∈ E}
	end if
	5.4.2 Functional Modules
	Message Interpretation and Scheduling:
	constructed as follows:

Table 5 .

 5 1: Comparison of a weight-imposed method with Liu's and generic methods ; our method yields more robust weight cost in the sense that the MN's movement changes near the boundary affect a future position more than those away from it. In Table5.1, comparing d 1 with d 2 in our method, deviations at the end of the sequence impose a heavier weight on cost. Comparing d 1 with d 3 , our

	Edit distance	Our method Liu's Generic method [32]
	d 1 (12367, 12345) d 2 (62467, 34567)	4 3	∞ 3	2 3
	d 3 (34684, 34567) d 4 (34345, 12345) d 5 (32345, 23234)	6 3 1	∞ ∞ 1	3 2 3
	sequence of a pattern

Table 5 .

 5

	2: Parameters used in evaluation
	Defined parameters	Values
	length of TVA	5
	δ p in Eq. (5.13)	0.5
	p, q, r, s in f D	0.9, 0.45, 0.01, 0.99
	n in Eq. (5.1)	8
	δ d	3

Table 5 .

 5 [START_REF]Freenet[END_REF] shows the values of parameters used throughout the evaluation. TVAs are built by recording the variations of angles for 5 • t ticks. The direction θ is quantized into 8 regions. Unless specified otherwise, we will use these values.

M1. STA → AS: Auth-req(STAId, SN i )

The STA sends the AS an authentication request containing its identity (Id) and a fresh nonce. On receipt of the message, the AS fetches credential corresponding to the Id and extracts its key from it. M2. AS → STA: Auth-chal(MAC PK [STAId, SN i , ASN j , 'authch'])

The AS uses the STA's nonce to compute a MAC, which protects from a reply attack.

M3. STA → AS: Chal-res(MAC PK [STAId, SN i+1 , ASN j , 'authres'])

If the received MAC is matched with the one that the STA generates, the AS is authenticated to the STA. Subsequently, the STA responds to the challenge.

Otherwise, the message is silently ignored.

M4. AS → STA: Auth-res(ENC DK

If the STA is successfully authenticated as well, the AS adds a secret value, i.e. ASN j+1 to a response message. During transfer of the message, the authenticator inserts a newly generated nonce AUN k that is used to compute a temporary key (TK). Meanwhile, the AS computes and sends a set of authentication value pairs (AVPs) to the SCR.

When the STA re-associates with another AP in (another) subnet, the following messages are exchanged.

M5. STA →

The STA computes a MAC, using the secret value obtained in the previous round of A MAC, including client nonce cn ′ from the received message and server nonce sn i , is computed and sent to the STA of Id i . The MAC allows the STA to verify the AS's authenticity. DK is computed by calculating an n-bit key generating pseudo random function (PRF) -in most cases n=128 is sufficient -with PK and the previously-exchanged nonces. An MIC provides a means of verifying authenticity once the associated MAC is verified successfully. A hashed domain key, DK + , is generated by applying α times a cryptographic one-way function H, equivalently H α (x) = H α-1 H(x) and H 0 (x) = x. The α value is a sync-one shared between the STA and the AS/SCR. DK + allows DK to be hidden from the authenticators. After the message exchanges, the server module creates the STA's security context that is composed primarily of the set of AVPs. It is then transferred to the corresponding SCR. The AVPs enable the SCR to conduct the re-authentication and re-keying process on behalf of the AS.

MAP SC Module

The SC module handles an incoming message (i.e. reauth-req) and an outgoing message (i.e. reauth-res) which are related to re-authentication. In particular, this module can be ods: the linear model fit by least squares and the k-nearest neighbor prediction rule [START_REF] Hastie | The Elements of Statistical Learning[END_REF].

The linear model is known to yield stable but possibly inaccurate predictions, while the method of k-nearest neighbors makes prediction accurate but can be unstable -any particular subregion of a decision boundary depends on a handful of input points and their particular positions. These two are complementary, and will be used to classify patterns for prediction.

In the least-squares methods, given a column vector of inputs X=(X 1 , . . ., X p ), we predict the output Y via the linear model in vector form as an inner product

where X T denotes the transpose of vector X, and β denotes the prediction of bias. We fit the linear model to a set of training set by using the least-squares method. We choose coefficients β by minimizing the residual sum of squares

where y is the output in the training set. If X T X is non-singular, then the unique solution is

given by

and the fitted value at the i-th input x i is ŷ = x T i β, which is the prediction. On the other hand, the k-nearest neighbor fit for Ŷ is defined as:

Authentication: The SCR allows a plug-in authentication protocol -which is required to create a security context -to run on the authentication module. On behalf of the home server, the SCR can execute the mobile authentication/authorization procedure based on the created security context. The execution policy (one-way/mutual authentication, or resource grant) is contingent upon the specification of the protocol.

Reduction in Storage Overhead

When

where n t i is the number of replicas in the i-th unit of time, t i . Due to the fact that there may already be obsolete replicas in S x (and if so, it is just updated), the amount of occupied storage n t appears at first a linear-but down-curve-like increase over time. Therefore, n t is viewed as a multiplied cumulative function represented as N × F(X), where N is the total number of MNs and F(X) is a Gamma cumulative distribution with a random variable as expected, achieving a significant reduction in the storage overhead under any distribution. With δ p ≤ 0.2, Beta (α=0.5, β=0.5) and uniform distributions also fit the estimation method (in Figure 5.11-(a)), but their false negative rate increases steeply (in Figure 5.11-(b)). Nevertheless, the overall risk under all distributions is kept lower than 5% of the rate.

In general, the effectiveness of the estimation method is maximized when f S assumes a normal Gaussian distribution. Uniform and Beta (α=0.5, β=0.5) distributions yielded results similar to those of a normal Gaussian distribution, while for a Beta (α=0.5, β=0.5) distribution, it operates effectively when |G(x)|≥ 3.

Related Work