No abstract

An architecture for providing multi-factor authentication as a service is proposed, resting on the principle of a loose coupling and separation of duties between network entities and end user devices. The multi-factor authentication architecture leverages Identity Federation and Single-Sign-On technologies, such as the OpenID framework, in order to provide for a modular integration of various factors of authentication. The architecture is robust and scalable enabling service providers to define risk-based authentication policies by way of assurance level requirements, which map to concrete authentication factor capabilities on user devices.

With the increasing demand for mobile data services and increased availability of multimode devices with multiple wireless interfaces, seamless mobility and service continuity across heterogeneous networks has become a differentiating service for Operators to offer users an enhanced mobile experience. In recent years, the Federated Identity Management (IdM) standards and technologies have rapidly evolved to address security, user experience, and privacy needs from an application layer perspective or as seen from the end user. As a result of these Federated IdM activities, a Single SignOn (SSO) concept has been created in which a user may use a single set of authentication credentials to gain access to multiple independent Application Services. This paper provides an overview of the various layers of security in a communications protocol stack and then presents an approach to achieve seamless mobility across heterogeneous networks based on Federated Identity systems. By leveraging a pre-established application layer security association, access layer authentication and setup of a secure channel in an on-demand, automated and seamless manner may be carried out whilst roaming across disparate networks.

Anonymity is a desirable feature for vehicle-to-vehicle (V2V) communications, but it conflicts with other requirements such as non-repudiation and revocation. Existing, pseudonymbased V2V communications schemes rely on certificate generation and signature verification. These schemes require cumbersome key management, frequent updating of certificate chains and other costly procedures such as cryptographic pairings. In this paper, we present novel V2V communications schemes, that provide authentication, authorization, anonymity, non-repudiation, replay protection, pseudonym revocation, and forward secrecy without relying on traditional certificate generation and signature verification. Security and privacy of our schemes rely on hard problems in number theory. Furthermore, our schemes guarantee security and privacy in the presence of subsets of colluding malicious parties, provided that the cardinality of such sets is below a fixed threshold.

Abstract-On the one hand, the challenge of meeting various security requirements in the mobile and wireless environment is difficult, compared to the fixed and wired environment, because of the very nature of radio communications. On the other hand, wireless networks such as GSM, PCS and CDMA, which are predominantly circuit-switched voice networks, have been shielded from the vulnerabilities that exist in the Internet. With the introduction of the IP multimedia subsystems (IMS) solutions, data, voice and video will be accessible using UMTS and CDMA2000 networks via the Internet. The current mobile equipment has the capability to work with multiple radio interfaces using heterogeneous radio access networks. Mobile subscribers have also become truly mobile since they are not constrained by mobile equipment, networks and applications. However, information between individuals has to be protected. Therefore, there will exist always the notion of private and public communications. In the mobile and wireless environment, the challenge is private communications between peers over non private domains. This paper describes schemes offering secure communications between mobile nodes using virtual private networking technologies based on IP security (IPSec). In addition, mobility management is done using mobile IP along with route-optimization techniques. This paper also describes how latencies suffered by real-time traffic when traversing IPSec and mobile IP tunnels can be reduced so that real-time delay constraints can be meet.