doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 1 Authentication and Key Management of MP with multiple radios Date: Authors:

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 2 Abstract This presentation states the secure association setup problem when the MP with multiple radios joins into the mesh network.

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 3 Agenda Problem Statement Suggestions

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 4 Current Secure association setup mechanism Step2: Authenticate with AS through MKD –Build the root of trust, i.e., MSK/PSK. Key derivation mechanism –Derive PMK-MKD to distribute session keys between MPs. –Derive MKDK to establish secure link between MP and MKD. Step1: Authentication Method & Role & Key Management type Negotiation Step2:Authentication through MKD & The key hierarchy setup Step3: PTK/GTK distribution 4-Way handshake to build session keys Probe/Beacon Secure communication Peer Link Management Initial Authentication if needed Supplicant Mesh Authenticator

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide s Key Hierarchy According to the current Key derivation mechanism –There will be multiple PMK-MKDs and MKDKs when the multiple radios MPs join the mesh network, because the MPs should have to use different SPA corresponding to different radio to differ the radios in order to derive PMK-MKD and MKDK. MeshTopLevelKeyData = KDF-768(XXKey, “Mesh Key Derivation”,MeshID, MKD-NAS-ID, MKDD-ID, SPA) –Multiple initial authentication procedures should have to be launched. Held by MKD, Supplicant & MA PMK-MA=KDF-256(PMK-MKD,”MA Key Derivation”, PMK-MKDName|| MA-ID|| SPA) MSK/PSK Held by MKD & Supplicant PMK-MKD = L(MeshTopLevelKeyData, 0, 256) Held & Derived by Supplicant & MA PTK=KDF(PMK-MA,”Mesh PTK key derivation”,MPTKSNonce|| MPTKANonce|| MA-ID||SPA||PMK-MAName) Held by Supplicant & MKD MKDK = L(MeshTopLevelKeyData, 384, 256) Held & Derived by Supplicant & MKD, deliver PMK-MA MPTK-KD=KDF-256(MKDK, “Mesh PTK-KD Key”,MA-Nonce||MKD- Nonce||MA-ID||MKD-ID) PMK-MA PMK-MKD PTK MKDK MPTK-KD Key Distribution branch Link Security Branch

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 6 Disadvantages of multiple authentications Can not detect the authentication credential is used for different MPs or different radios in the same MP simultaneously. –The authentication credential may be used by multiple MPs simultaneously. Increase the air cost overhead when launching multiple times initial authentication

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 7 Agenda Problem Statement Suggestions

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 8 Solution Requirements The initial authentication should only be launched once when an MP join the mesh network, no matter how many radios it has. –Authentication credential is issued one per device –Authenticate the device to produce trust credential secrecy –Doesn’t rely on the concrete authentication credential and authentication methods Different radio in the same MP should use different session key. –Distribute keys for radios of the device through One time initial authentication procedure Follow the s security requirements –Authentication process is to build the root of trust relationship and authorize the device to use the trust credential; such as MSK etc –The key management has to work at the MAC layer –The SAs has to be tied to the MAC addresses Less modification, more better

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 9 Possible solution AS Sup MP MAMKD 2. EAPOL (EAP-Request Identity) 3. EAPOL (EAP-Response Identity) 5. EAP Transport (EAP-Response Identity) 7. EAP Transport (EAP- Success, MSK) 9. EAPOL (EAP-Success) 1. EAPOL-Start 4. Mesh EAP encapsulation (EAP-Response Identity) Derive Pairwise Key (PMK-MKD, MKDK, PMK-MA) 8. Mesh EAP encapsulation(EAP- Response Accept PMK-MA) 6. EAP-specific (mutual) authentication Only one PMK-MKD and one MKDK for an MP, shared by all the radios –Introduce device ID which can only identify the MP, i.e., prime address –Using the Dev_ID instead of SPA when deriving MeshTopLevelKeyData MeshTopLevelKeyData = KDF-768(XXKey, “Mesh Key Derivation”,MeshID, MKD-NAS-ID, MKDD- ID, Dev_ID) No modification to the derivation formulas of the PMK-MA, PTK and MPTK-KD –Different Session Keys is derived for different radios The SPA is the communication radio’s MAC address of the MPs No modification of the 4-way handshake.

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 10 Mesh key holder security handshake Modification The MKDK is indexed the MA_ID in the MKD according to the current mechanism –The transmission address of handshake message 1 It is not suitable in our solutions, because the MA_ID has been changed to Dev_ID –Using the MKDKName to index the MKDK to establish secure association between MP and MKD.

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 11 Mesh key holder security handshake Modification The MKDK is indexed the MA_ID in the MKD according to the current mechanism –The transmission address of handshake message 1 It is not suitable in our solutions, because the MA_ID has been changed to Dev_ID –Using the MKDKName to index the MKDK to establish secure association between MP and MKD.

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 12 Straw Poll Would you like to use Dev_ID for deriving PMK- MKDs and MKDKs to enhance the authentication procedure of multiple radios MPs? Yes No

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 13 Reference Draft_P802.11s_D1.09

doc.: IEEE r1 Submission March 2008 Charles Fan,Amy Zhang, HuaweiSlide 14 Back Up The radios can use MIC to prove its legality a.To MKD when doing the Mesh key holder security handshake -ONLY the authorized device have the MPTK-KD to compute the MIC. b.To other MPs when doing the 4-Way handshake -ONLY the authorized device have the AKCK derived from PMK-MA to compute the MIC. MP MKD 1,MANonce,MA-ID ， MKD-ID ， MKDKName 2,MANonce,MKDNonce,MA-ID ， MKD-ID ， MKDKName,MIC 3,MANonce,MKDNonce,MA-ID ， MKD-ID ， MKDKName,MIC 4,MANonce,MKDNonce,MA-ID ， MKD-ID ， MKDKName,MIC MP 1,MANonce,SPA,MA-ID,MKDD-ID,PMK-MKDName 2,SPANounce,MANonce,SPA,MA-ID,MKDD-ID,PMK-MKDName,MIC 3,SPANounce,MANonce,SPA,MA-ID,MKDD-ID,PMK-MKDName, MIC 4,SPANounce,MANonce,SPA,MA-ID,MKDD-ID,PMK-MKDName,MIC a. Mesh key holder security handshake b. 4-Way handshake