Internet Authentication for Remote Access

by Paulo Sergio Pagliusi

RHUL-MA-2008-15 

Abstract:

It is expected that future IP devices will employ a variety of
different network access technologies to gain ubiquitous
connectivity. Currently there are no authentication protocols
available that are lightweight, can be carried over arbitrary
access networks, and are flexible enough to be re-used in the
many different contexts that are likely to arise in future
Internet remote access. Furthermore, existing access procedures
need to be enhanced to offer protection against
Denial-of-Service (DoS) attacks, and do not provide
non-repudiation. In addition to being limited to specific
access media, some of these protocols are limited to specific
network topologies and are not scalable.

This thesis reviews the authentication infrastructure
challenges for future Internet remote access supporting
ubiquitous client mobility, and proposes a series of solutions
obtained by adapting and reinforcing security techniques
arising from a variety of different sources. The focus is on
entity authentication protocols that can be carried both by the
IETF PANA authentication carrier and by the EAP mechanisms, and
possibly making use of an AAA infrastructure. The core idea is
to adapt authentication protocols arising from the mobile
telecommunications sphere to Internet remote access. A proposal
is also given for Internet access using a public key based
authentication protocol. The subsequent security analysis of
the proposed authentication protocols covers a variety of
aspects, including: key freshness, DoS-resistance, and
"false-entity-in-the-middle" attacks, in addition to identity
privacy of users accessing the Internet via mobile devices.

This work aims primarily at contributing to ongoing research on
the authentication infrastructure for the Internet remote
access environment, and at reviewing and adapting
authentication solutions implemented in other spheres, for
instance in mobile telecommunications systems, for use in
Internet remote access networks supporting ubiquitous mobility.