MobiSEC: a novel security architecture for wireless mesh networks

ABSTRACT

Wireless mesh networks (WMNs) have emerged recently as a technology for next-generation wireless networking.

In this paper we propose MobiSEC, a complete security architecture that provides both access control for mesh users and routers as well as security and data confidentiality of all communications that occur in the WMN.

MobiSEC extends the IEEE 802.11i standard exploiting the routing capabilities of mesh routers; after connecting to the access network as generic wireless clients, new mesh routers authenticate to a central server and obtain a temporary key that is used both to prove their credentials to neighbor nodes and to encrypt all the traffic transmitted on the wireless backbone links.

A key feature in the design of MobiSEC is its independence from the underlying wireless technology used by network nodes to form the backbone; furthermore, MobiSEC permits seamless mobility of both mesh clients and routers.

We implemented MobiSEC in a real-life test-bed and measured its performance in different network scenarios.

Numerical results show that our proposed architecture increases considerably the WMN security with a negligible impact on the network performance, thus representing an effective solution for wireless mesh networking.

REFERENCES

• 1: IEEE Standard 802.11i. Medium Access Control (MAC) security enhancements, amendment 6. IEEE Computer Society, 2004.
• 2: IEEE Standard 802.1X. Port-Based Network Access Control. IEEE Computer Society, 2004.
• 3: B. Aboba, L. Blunk, J. Vollbrecht, J. Carlson, and H. Levkowetz. Extensible Authentication Protocol (EAP). RFC 3748, June 2005.
• 4: B. Aboba , D. Simon, PPP EAP TLS Authentication Protocol, RFC Editor, 1999
• 5: C. Adjih, T. Clausen, P. Jacquet, A. Laouiti, P. Mühlethaler, and D. Raffo. Securing the OLSR protocol. In Proceedings of the IFIP Med-Hoc-Net, Mahdia, Tunisie, June 2003.
• 6: C. Adjih, D. Raffo, and P. Mühlethaler. Attacks against OLSR: Distributed key management for security. In Proceedings of the 1st OLSR Interop and Workshop, August 2005.
• 7: Ian F. Akyildiz , Xudong Wang , Weilin Wang, Wireless mesh networks: a survey, Computer Networks and ISDN Systems, v.47 n.4, p.445-487, 15 March 2005 [doi>10.1016/j.comnet.2004.12.001]
• 8: W. Arbaugh, N. Shankar, Y. Wan, and K. Zhang. Your 802.11 wireless network has no clothes. Wireless Communications, IEEE, 9(6):44--51, Dec. 2002.
• 9: N. Ben Salem and J.-P. Hubaux. Securing wireless mesh networks. Wireless Communications, IEEE, 13(2):50--55, April 2006.
• 10: A. Botta, A. Dainotti, and A. Pescapé. Multi-protocol and multi-platform traffic generation and measurement. In Infocom '07 DEMO Session, volume 45, pages 526--532, May 2007.
• 11: R. Bruno, M. Conti, and E. Gregori. Mesh networks: commodity multihop ad hoc networks. Communications Magazine, IEEE, 43(3):123--131, March 2005.
• 12: A. Capone, S. Napoli, and A. Pollastro. MobiMESH: An experimental platform for wireless mesh networks with mobility supports. In WiMESHNets '06: Proceedings of the 1st ACM workshop on Wireless mesh: moving towards applications. ACM, August 2006.
• 13: O. Cheikhrouhou, M. Laurent-Maknavicius, and H. Chaouchi. Security architecture in a multi-hop mesh network. June 2006.
• 14: R. Fantacci, L. Maccari, T. Pecorella, and F. Frosali. A secure and performant token-based authentication for infrastructure and mesh 802.1X networks. April 2006.
• 15: Scott R. Fluhrer , Itsik Mantin , Adi Shamir, Weaknesses in the Key Scheduling Algorithm of RC4, Revised Papers from the 8th Annual International Workshop on Selected Areas in Cryptography, p.1-24, August 16-17, 2001
• 16: Yih-Chun Hu , Adrian Perrig , David B. Johnson, Ariadne: a secure on-demand routing protocol for ad hoc networks, Wireless Networks, v.11 n.1-2, p.21-38, January 2005 [doi>10.1007/s11276-004-4744-y]
• 17: Mohamed Kassab , Abdelfettah Belghith , Jean-Marie Bonnin , Sahbi Sassi, Fast pre-authentication based on proactive key distribution for 802.11 infrastructure networks, Proceedings of the 1st ACM workshop on Wireless multimedia networking and performance modeling, October 13-13, 2005, Montreal, Quebec, Canada [doi>10.1145/1089737.1089746]
• 18: Nikos Komninos , Dimitris Vergados , Christos Douligeris, Detecting unauthorized and compromised nodes in mobile ad hoc networks, Ad Hoc Networks, v.5 n.3, p.289-298, April, 2007 [doi>10.1016/j.adhoc.2005.11.005]
• 19: Haiyun Luo , Petros Zerfos , Jiejun Kong , Songwu Lu , Lixia Zhang, Self-Securing Ad Hoc Wireless Networks, Proceedings of the Seventh International Symposium on Computers and Communications (ISCC'02), p.567, July 01-04, 2002
• 20: Nikola Milanovic , Miroslaw Malek , Anthony Davidson , Veljko Milutinovic, Routing and Security in Mobile Ad Hoc Networks, Computer, v.37 n.2, p.61-65, February 2004 [doi>10.1109/MC.2004.1266297]
• 21: A. Mishra and W. A. Arbaugh. An initial security analysis of the IEEE 802.1X standard. UM Computer Science Department, Technical Report CS-TR-4328, February 2002.
• 22: M. Ossmann. WEP: Dead again. http://securityfocus.com/infocus/1814, 2004.
• 23: Bryan Parno , Adrian Perrig , Virgil Gligor, Distributed Detection of Node Replication Attacks in Sensor Networks, Proceedings of the 2005 IEEE Symposium on Security and Privacy, p.49-63, May 08-11, 2005 [doi>10.1109/SP.2005.8]
• 24: A. Prasad and H. Wang. Roaming key based fast handover in WLANs. Wireless Communications and Networking Conference, 2005 IEEE, 3:1570--1576, March 2005.
• 25: Daniele Raffo , Cédric Adjih , Thomas Clausen , Paul Mühlethaler, An advanced signature system for OLSR, Proceedings of the 2nd ACM workshop on Security of ad hoc and sensor networks, October 25-25, 2004, Washington DC, USA [doi>10.1145/1029102.1029106]
• 26: Kimaya Sanzgiri , Bridget Dahill , Brian Neil Levine , Clay Shields , Elizabeth M. Belding-Royer, A Secure Routing Protocol for Ad Hoc Networks, Proceedings of the 10th IEEE International Conference on Network Protocols, p.78-89, November 12-15, 2002
• 27: W. Stallings. Cryptography and Network Security, Fourth Edition. McGraw-Hill, September 2003.
• 28: D. Stanley, J. Walker, and B. Aboba. Extensible Authentication Protocol (EAP) method requirements for wireless LANs. RFC 4017, March 2005.
• 29: Adam Stubblefield , John Ioannidis , Aviel D. Rubin, A key recovery attack on the 802.11b wired equivalent privacy protocol (WEP), ACM Transactions on Information and System Security (TISSEC), v.7 n.2, p.319-332, May 2004 [doi>10.1145/996943.996948]
• 30: L. Zhou and Z. Haas. Securing ad hoc networks. Network, IEEE, 13(6):24--30, November 1999.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.1 Network Architecture and Design
          Subjects: Wireless communication

General Terms:
Performance, Security

Keywords:
authentication, experimental test-bed, security, wireless mesh networks