toward adjustable lightweight authentication for network access control

209 Pages·2005·3.03 MB·English

LT
IO
G
W
H
ABSTRACT
TA
WR
The increasing use of Internet access networks fl uid fl ow model and throughput histogram diffe- D
E
raises the demand for secure and reliable com- rences. The results emphasize the possibility of a I A TOWARD ADJUSTABLE LIGHTWEIGHT
G
munication for both users and businesses. Tradi- Denial of Service (DoS) attack against IPSec itself. D
HJ AUTHENTICATION FOR NETWORK
tionally, the aim has been to provide the strongest TU
possible security. However, with the demand for The redundant authentication performed in a AS ACCESS CONTROL
T
low-power computing it has become desirable Wireless Local Area Network (WLAN) also mo- UA
TB
to develop security mechanisms which effi ciently tivates the development and evaluation of novel
HL
utilize available resources. The tradeoff between lightweight authentication protocols for the link EE
N
performance and security plays an important role. and network layer. The developed authentication
T
In general, strong security is added even if there protocols are resource effi cient, per-packet based, I
C
is no attack. The implementation of strong and and robust in terms of handling packet loss. The
A
resource demanding security often implies more protocols are further used as part of a hierarchi- T
I
than a secure system; it may deteriorate the per- cal defense structure, which has been implemen- O
N Henric Johnson
formance of a device with limited resources and ted and evaluated, in order to mitigate protocol

pave the way for new threats such as resource based DoS attacks. F
O
exhaustion. It is, therefore, unwise to use strong
R
cryptographic algorithms for devices with limited Finally, this thesis presents the concept of Always N
resources in the absence of an adversary. It is more Best Security (ABS) and a practical decision ma- E
T
effi cient to begin with lightweight security, taking king model based on the Analytic Hierarchy Pro-
W
further measures when an attack is detected. cess. The model takes a number of factors into
O
consideration, including subjective and objective R
The overall focus of this thesis is on adjustable aspects of security in order to select an adequate K
A
and lightweight authentication protocols for net- authentication level. It is a fl exible model which
C
work access control. The thesis studies the per- formalizes quantitative and qualitative considera- C
formance degradation of strong security using tions of a defi ned set of criteria, keeping Quality E
S
empirical tests on IP security (IPSec) with a visual of Service in mind. S

bottleneck indicator based on the time-discrete C
O
N
T
R
O
L
H
e
n
r
ic

Jo
h
n
s
o
n
Blekinge Institute of Technology
Doctoral Dissertation Series No. 2005:09
2
0 School of Engineering
ISSN 1653-2090 0
5
2005:09 ISBN 91-7295-077-3 :09

Toward Adjustable
Lightweight Authentication
for Network Access
Control
Karlskrona, December 2005
Department of Telecommunication Systems
School of Engineering
Blekinge Institute of Technology
S-371 79 Karlskrona, Sweden
Copyright (cid:1)c 2005, Henric Johnson. All rights reserved.
Blekinge Institute of Technology
Doctoral Dissertation Series No. 2005:09
ISSN 1653-2090
ISBN 91-7295-077-3
Published 2005
Printed by KaserntryckerietAB
Karlskrona 2005
Sweden
This publication was typeset using LATEX.
To Vicky and Wiktor

v
Abstract
The increasing use of Internet access networks raises the demand for se-
cureandreliablecommunicationforbothusersandbusinesses. Traditionally,
the aim has been to provide the strongest possible security. However, with
the demand for low-power computing it has become desirable to develop se-
curity mechanisms which efficiently utilize available resources. The tradeoff
betweenperformanceandsecurityplaysanimportantrole. Ingeneral,strong
securityisaddedevenifthereisnoattack. Theimplementationofstrongand
resource demanding security often implies more than a secure system; it may
deteriorate the performance of a device with limited resources and pave the
way for new threats such as resource exhaustion. It is, therefore, unwise to
use strong cryptographic algorithms for devices with limited resources in the
absenceofanadversary. Itismoreefficienttobeginwithlightweightsecurity,
taking further measures when an attack is detected.
Theoverallfocusofthisthesisisonadjustableandlightweightauthentica-
tion protocols for network access control. The thesis studies the performance
degradation of strong security using empirical tests on IP security (IPSec)
with a visualbottleneck indicatorbasedonthe time-discrete fluidflow model
and throughput histogram differences. The results emphasize the possibility
of a Denial of Service (DoS) attack against IPSec itself.
TheredundantauthenticationperformedinaWirelessLocalAreaNetwork
(WLAN) also motivates the development and evaluation of novel lightweight
authentication protocols for the link and network layer. The developed au-
thentication protocols are resource efficient, per-packet based, and robust in
terms of handling packet loss. The protocols are further used as part of a
hierarchical defense structure, which has been implemented and evaluated in
order to mitigate protocol based DoS attacks.
Finally,thisthesispresentstheconceptofAlwaysBestSecurity(ABS)and
a practical decision making model based on the Analytic Hierarchy Process.
The model takes a number of factors into consideration, including subjective
andobjectiveaspectsofsecurityinordertoselectanadequateauthentication
level. It is a flexible model which formalizes quantitative and qualitative
considerations of a defined set of criteria, keeping Quality of Service in mind.

vii
Preface
This thesis reports on my research in the field of network security. The
work has been carried out at the School of Engineering at Blekinge Institute
of Technology. Most of the work has been conducted in collaboration with
the securitylabattheUniversityofCaliforniaDavis(UCDavis). Partsofthe
thesis material have appeared in the following publications:
1. H. Johnson, A. Nilsson, and M. Fiedler, Wireless Network Security, In
Proceedings ofNordic RadioSymposiumConference (NRS01),ISBN91-
631-0755-4,Nyna¨shamn, Sweden, April 2001.
2. H. Johnson, Security in Lightweight Ad Hoc Networks, In Proceedings
of Promote IT 2002, Sko¨vde, Sweden, April 2002.
3. H.Johnson,A.Nilsson,J.Fu,S.F.Wu,A.ChenandH.Huang,SOLA:
AOne-bitIdentityAuthentication Protocolfor AccessControlinIEEE
802.11, In Proceedings of IEEE Global Telecommunications Conference
(GLOBECOM’02), Taipei, Taiwan, Vol 1, pages 768–772, November
2002.
4. F. Zhao, C. Shin, S. F. Wu, H. Johnson, R. C. Guo, T. J. Liu, K. P.
Fan, and J. Fu, A Framework for Data PacketAccess Control(DPAC),
IETF draft <draft-zhao-pana-dpac-framework-00.txt>,February 2003.
5. B. M˚artensson, S. Chevul, H. Ja¨rnliden, H. Johnson, and A. Nilsson,
SuxNet-ImplementationofSecureAuthenticationforWLAN,Research
Report2003:03,ISSN:1103-1581,BlekingeInstituteofTechnology,Swe-
den, December 2003.
6. F. Zhao, Y. Shin, S. F. Wu, H. Johnson, and A. Nilsson, RBWA:
An Efficient Random-Bit Window-based Authentication Protocol, In
Proceedings of IEEE Global Telecommunications Conference (GLOBE-
COM’03), San Francisco, USA, pages 1379–1383,December 2003.
viii
7. H.Johnson,A.Nilsson,S.F.WuandF.Zhao,LightweightAuthentica-
tion for Bluetooth, In Proceedings of the first International Conference
on Mobile Computing and Ubiquitous Networking (ICMU) 2004, ISBN
4-902523-00-0, NTT DoCoMo R&D Center, Yokusuka, Japan, pages
106–111,January 2004.
8. H. Johnson, Lightweight Authentication in Wireless Networks, Licen-
tiate Thesis, Blekinge Institute of Technology, Sweden, ISBN 91-7295-
034-x,January 2004.
9. H.JohnsonandA.Nilsson,DetectionandResponsePoliciesUsingaHi-
erarchicalScheme, In Proceedings of Promote IT 2004, ISBN 91-85019-
93-3, Karlstad, pages 258–268,May 2004.
10. S. F. Wu, H. Johnson, A. Nilsson, SOLA: Lightweight Security for Ac-
cess Controlin IEEE802.11,IEEE CS Journal IT Professional, Vol. 6,
No.3, pages 10–16, May/June 2004.
11. H.Johnsonet al.,A ReportonSecurity Conceptsfor Mobile andWire-
less IP Networks, Chapter 5, S. J. Knapskog, and M. Fiedler (eds.),
Euro-NGI: Deliverable D.JRA.6.3.1, December 2004.
12. H. Johnsonet al., Specification of a Key ManagementProtocolfor Mo-
bile Networks, Chapter 3, R. Lupu, S. J. Knapskog, and M. Fiedler
(eds.), Euro-NGI: Deliverable D.JRA.6.3.3, May 2005.
13. H.Johnsonetal.,AssessmentofDifferentSecurityConcepts forMobile
and Wireless IP Networks, Chapter 3, A Gutscher, S Kiesel, and M.
Fiedler (eds.), Euro-NGI: Deliverable D.JRA.6.3.2, May 2005.
14. S. Hong, F. Wong, S. F. Wu, B. Lilja, T. Jansson, H. Johnson and A.
Nilsson, TCPtransform: Property-Oriented TCP Traffic Transforma-
tion, In Proceedings of GI/IEEE SIG SIDAR Conference on Detection
of Intrusions and Malware & Vulnerability Assessment (DIMWA 2005),
Vienna, Austria, LNCS, Springer, July 2005.