Efficient authentication for fast handover in wireless mesh networks

Abstract

We propose new authentication protocols to support fast handover in IEEE 802.11-based wireless mesh networks. The authentication server does not need to be involved in the handover authentication process. Instead, mesh access points directly authenticate mobile clients using tickets, avoiding multi-hop wireless communications in order to minimize the authentication delay. Numerical analysis and simulation results show that the proposed handover authentication protocol significantly outperforms IEEE 802.11 authentication in terms of authentication delay.

Introduction

A wireless mesh network (WMN) consists of mesh clients and mesh points (routers). Mesh clients can be static (e.g., desktops, database servers) or mobile hosts (e.g., cell phone, laptops, PDAs). The MPs form a wireless mesh backbone to provide multi-hop connectivity from one mesh client to another or to the Internet. A subset of mesh points act as mesh access points (MAPs), connecting mesh clients to the WMN. A small number of mesh points work as gateways, connecting the WMN to the Internet.

A WMN is dynamically self-organized and self-configured, with nodes in the network automatically establishing and maintaining mesh connectivity among themselves. This feature brings many benefits to IEEE 802.11-based mesh networks such as low installation cost, large-scale deployment, fault-tolerance, and self-management.

Wireless mesh networks support many important applications such as Internet access provisioning in rural areas, ad hoc networking for emergency and disaster recovery, security surveillance, and information services in public transportation systems, airports, shopping malls, and stadiums. The technology enables networking capability where wiring or installing cables is difficult or expensive and deployment time is a concern.

With the rapid growth of mobile services for handheld devices such as smartphones, tablets and laptops, Internet connectivity anytime anywhere has become a necessity in every day life, business, education and entertainment. While cellular networks effectively handle the handoff problem using signaling embedded in their low-level protocols, there are currently no efficient, transparent handoff solutions for IEEE 802.11-based wireless networks. At the moment, these networks, even if they give the appearance of continuous connectivity to a roaming client, provide connections that are in fact often interrupted when a client transfers from one access point to the next, because handover delays can be as long as several seconds (Velayos and Karlsson, 2003). For some applications (e.g. transferring files), this delay is acceptable; however, it is far too long for real-time traffic such as interactive voice over IP or video conferencing (Amir and Danilov, 2006).

The current version of wireless mesh networking standards IEEE 802.11s does not specify any mechanisms to support fast hand-off for mobile clients. A mesh client has to be authenticated by an authentication server via multi-hop wireless communications, which may result in long delay, low reliability and thus potential service interruption. A performance study of message transmission delay in IEEE 802.11-based mesh networks by Srivatsa and Xie (2008) shows that as the number of wireless hops between two routers increases from one to five, the delay of a message between a client and an authentication server increases from 0.15 s to 0.8 s. Since the authentication process involves several messages (e.g., nine messages in the EAP-TLS protocol used by 802.11s), the handoff latency may be several seconds long, which is not tolerable in real-time applications such as VoIP, newscast, and stock quote distribution.

Our work in this paper contributes toward extending the IEEE 802.11s standards to support fast roaming for mobile clients. In particular, we focus on fast authentication during the hand-off process as well as during the initial login time. We propose a new trust model for WMNs based upon which our proposed authentication protocols are designed. We present ticket-based authentication protocols that are efficient and resilient to attacks. The authentication server does not need to be involved in the handover authentication. Instead, mobile clients' authentications are done by mesh access points, avoiding multi-hop wireless communications. Fast authentication from one MAP to another during the hand-off process is supported using tickets (Kohl and Neuman, 1993). Numerical analysis and simulation results show that our login authentication protocol improves the latency of 802.11s login authentication, and our handover authentication protocol supports fast authentication during the hand-off process, which is lacking in 802.11s.

The remainder of the paper is organized as follows. Related work is discussed in Section 2. We describe the ticket types used in the proposed authentication protocols in Section 3. In Section 4, we present our login and handover authentication protocols. Security analysis is discussed in Section 5. Performance evaluations of the proposed protocols are given in Section 6. Section 7 concludes the paper and outlines our future work.