Improved IPSec tunnel establishment for 3GPP–WLAN interworking

Abstract

Interworking between wireless local area network (WLAN) and the 3rd Generation Partnership Project (3GPP) such as Long Term Evolution (LTE) is facing more and more problems linked to security threats. Securing this interworking is a major challenge because of the vastly different architectures used within each network. Therefore, security is one of the major technical concerns in wireless networks that include measures such as authentication and encryption. Among the major challenges in the interworking security is the securing of the network layer. The goal of this article is twofold. First, we propose a new scheme to secure 3GPP LTE-WLAN interworking by the establishment of an improved IP Security tunnel between them. The proposed solution combines the Internet Key Exchange (IKEv2) with the Host Identity Protocol (HIP) to set up a security association based on two parameters, which are location and identity. Our novel scheme, which is called HIP_IKEv2, guarantees better security properties than each protocol used alone. Second, we benefit from Mobile Internet Key Exchange protocol (MOBIKE) in case of mobility events (handover). And we extend HIP_IKEv2 to HIP_MOBIKEv2 protocol in order to reduce the authentication signaling traffic. The proposed solution reinforces authentication, eliminates man-in-the-middle attack, reduces denial-of-service attack, assures the integrity of messages, and secures against reply attack. Finally, our proposed solution has been modeled and verified using the Automated Validation of Internet Security Protocols and Applications and the Security Protocol Animator, which has proved its security when an intruder is present.First, the UE authenticates 3GPP_AAA server on AUTN and MAC sever . Then the 3GPP_AAA server authenticates the UE on RES. These three parameters are derived from the random number RAND. Thus, we have modeled this goal in HLPSL as follows:The same procedure is adopted to authenticate the UE by 3GPP_AAA server. Then, in the goal section of the protocol, we write the following: 8.2.2.2 Secrecy of the shared key The Diffie-Hellman shared key must only be known by the UE and the ePDG entities. The secret is the goal fact related to secrecy.This goal has been modeled in HLPSL as follows:Also, the Cipher Key CK and the Integrity Key IK must be a secret between UE and the 3GPP_AAA server to guarantee the secrecy of the Master Session Key MSK.This goal has been modeled in HLPSL, as follows:Then, in the goal section of the protocol, we write the following: 1195 3GPP-WLAN INTERWORKING some other types of attacks such as connection hijacking or impersonation, and trying to give solution for securing new mobility management protocols, such as FHMIPv6 and PMIPv6.

Cryptographic Algorithm Invocation Based on Software‐Defined Everything in IPsec

“…Meanwhile, the method of changing the cryptographic algorithms applying in IPsec for different application scenarios is becoming inefficient and complicated. At present, relevant work is mostly focused on adding IPsec cryptographic algorithms, establishing a security gateway for network communication, and the impacts of IPsec on network applications [16][17][18]. However, to the best of our knowledge, there is little research on the simplification and flexibility of algorithm invocation in IPsec.…”

Analysis and improvement of the Internet‐Draft IKEv3 protocol

“…The IKE protocol is always a hotspot of IPsec research, and the researches tend to focus on specification simplification, realization of interoperability, DoS attack resistance, and reflection attack resistance all along. In October 2014, updated IKEv2 (RFC 7296) was already standardized with better protection and accuracy.…”