Hanane Fathi

Network mobility (NEMO) allows an entire network to change its point of attachment to Internet. The NEMO basic support protocol has been specified recently, however Authentication Authorization and Accounting (AAA) issues have not been covered. Moreover the use of IPsec to secure NEMO procedures does not provide robustness against leakage of stored secrets. To address this security issue and to achieve AAA with mobility, we propose a new handover mechanism to be performed by Visiting Mobile Routers attached to a Mobile Router that serves as the gateway to the Internet (i.e. nested NEMO). This new AAA and handover procedure is based on Leakage Resilient-Authenticated Key Establishment (LR-AKE) protocol but new features are added to provide robustness against leakage of stored secrets at the server side.

Anonymity and specifically sender anonymity have become essential requirements for many privacy-related applications (e.g. net counselling and whistle blowing). On the other hand, anonymity may be abused for various malicious activities (e.g. redistribution of copy-righted contents and illegal drug trading). In this paper, we address both by proposing protocols for authenticated anonymous communications channels. In such channels, the client can authenticate the authentication server while the latter can only authenticate the fact that the client is one of the qualified members that are eligible to use the network (e.g. WLAN hot spots, WiMAX). Our protocols are based on an efficient anonymous password-based authenticated key exchange protocol and on an anonymous IP address assignment and have the following advantages: (1) they can restrict the usage of the established anonymous channels to certain fair purposes; (2) they do not involve rerouting of the packets through a chain of intermediate nodes; (3) they are available right after registration of a normal password to an authentication server as for a classical non-anonymous authentication (e.g. EAP-TTLS and PEAP) and do not require any special registration procedures that would reveal initially to the authentication server that the client belongs to a small list of users of anonymous services. Each protocol fits in a different authentication framework (IEEE802.1x and PANA) and is different with respect to providing controlled IP address assignment.

Network mobility introduces far more complexity than host mobility. To address the extensions needed for network mobility, the IETF NEMO working group has recently standardized the network mobility basic support protocol in RFC 3963. However, in this RFC, it is not mentioned how authentication authorization and accounting (AAA) issues are handled in NEMO environment. Also the use of IPsec to secure NEMO procedures does not provide robustness against leakage of stored secrets. To address this security issue and to achieve AAA with mobility, we propose new handover procedures to be performed by mobile routers and by visiting mobile nodes. These new handover procedures are based on leakage resilient-authenticated key establishment (LR-AKE) protocol.