Security architectures for B3G mobile networks

Abstract

This paper analyzes the security architectures employed in the interworking model that integrates thirdgeneration (3G) mobile networks and Wireless Local Area Networks (WLANs), materializing Beyond 3G (B3G) networks. Currently, B3G networks are deployed using two different access scenarios (i.e., WLAN Direct Access and WLAN 3GPP IP Access), each of which incorporates a specific security architecture that aims at protecting the involved parties and the data exchanged among them. These architectures consist of various security protocols that provide mutual authentication (i.e., user and network authentication), as well as confidentiality and integrity services to the data sent over the air interface of the deployed WLANs and specific parts of the core network. The strengths and weaknesses of the applied security measures are elaborated on the basis of the security services that they provide. In addition, some operational and performance issues that derives from the application of these measures in B3G networks are outlined. Finally, based on the analysis of the two access scenarios and the security architecture that each one employs, this paper presents a comparison of them, which aims at highlighting the deployment advantages of each scenario and classifying them in terms of: a) security, b) mobility, and c) reliability.Keywords B3G networks · 3G · WLAN · EAP-SIM · EAP-AKA · IKEv2 · 802.11i C. Xenakis ( ) · C. Ntantogian

Reducing False Synchronizations in 3G-WLAN Integrated Networks

“…The 3G-WLAN integrated network architecture consists of four individual parts [1], [7] (see Figure 1): (i) the MS, (ii) the UMTS radio AN (UTRAN), (iii) the WLAN, and (iv) the 3G core network. The MS comprises the user's device (e.g., laptop, smart phone) and the universal subscriber identity module (USIM), which contains the user's subscriber information.…”

A generic mechanism for efficient authentication in B3G networks

“…Each time that AVR is executed the requesting network receives L the size of fresh 3G AV [7]. A 3G AV includes a random challenge (RAND), the authentication token (AUTN), the expected response (XRES), the encryption key (CK) and the integrity key (IK) [6] [25]. To proceed with the EAP-AKA authentication, the AAA server selects a fresh AV and uses the CK and IK keys (of the selected AV) as well as the identity of the user to compute the EAP-AKA Master Key (MK).…”

One-Pass EAP-AKA Authentication in 3G-WLAN Integrated Networks

“…3 -step a9). Trying to avoid the double execution of EAP-AKA [26], 3GPP 23.234 [1] specifies that in cases that the PDG trusts the WLAN network, the first execution of EAP-AKA for registration in the WLAN domain can be omitted. Although this policy speeds up the authentication procedure, it may raise new security risks and threats.…”