doc.: IEEE /230r0 Submission Robert Moskowitz, Trusecure/ICSALabsSlide 1 March 2002 Proxied Preauthorized Roaming Robert Moskowitz Trusecure Corporation ICSALabs

doc.: IEEE /230r0 Submission Robert Moskowitz, Trusecure/ICSALabsSlide 2 March 2002 Goal Provide for fast authentication when a Station roams to a new AP –Establish Security Associations BEFORE REassociations –Use SAs to validate REassociations Allow for Stations to bounce between APs –Keep SAs around after DEassociations and IAPP ADDs and Moves Leverage off of 802.1x architecture, but account for complex AAA arrangements –Also work for preshared keyed DSs

doc.: IEEE /230r0 Submission Robert Moskowitz, Trusecure/ICSALabsSlide 3 March 2002 Benefits Most authentication done ‘behind the scenes’ Full pairwise session keys in STA and APs – Strict adherence to STA-AP-AS security model

doc.: IEEE /230r0 Submission Robert Moskowitz, Trusecure/ICSALabsSlide 4 March 2002 Requirements APs have a knowledge of their neighbors –BSSIDs with IP addresses –Manually entered or ‘learned’ via 11f Mechanism for Associated AP to provide this list to STA –In EAP Identity Request –Mechanism for STA to tell AP which of list to Proxy Auth Protocol for passing EAP packets over IP, e.g. PIC

doc.: IEEE /230r0 Submission Robert Moskowitz, Trusecure/ICSALabsSlide 5 March 2002 Process Flow 1 STA ASSOCIATEs and Authenticates (802.1x) with AP AP provides STA with list of its neighbor APs –BSSIDs and DSM IP addresses STA performs EAP auth with neighbor APs –EAP over IP between STA and neighbor AP e.g. PIC UDP with hop-wise protection –STA - local AP is TKIP/ACIP –local AP to neighbor AP is ESP with TGf SAs

doc.: IEEE /230r0 Submission Robert Moskowitz, Trusecure/ICSALabsSlide 6 March 2002

doc.: IEEE /230r0 Submission Robert Moskowitz, Trusecure/ICSALabsSlide 7 March 2002 Process Flow 2 STA REASSOCIATEs with new AP STA sends EAPOL Start AP sends list of neighbor APs to STA STA and AP enter rekey state using PSK STA uses list of neighbor APs to perform EAP auth with

doc.: IEEE /230r0 Submission Robert Moskowitz, Trusecure/ICSALabsSlide 8 March 2002

doc.: IEEE /230r0 Submission Robert Moskowitz, Trusecure/ICSALabsSlide 9 March 2002 Risks Excessive number of SAs on APs –Too many neighbor APs on some APs –non-mobile STAs setting up SAs with APs –Unused SAs will eventually time out

doc.: IEEE /230r0 Submission Robert Moskowitz, Trusecure/ICSALabsSlide 10 March 2002 Interaction with 11f AP gets its list of neighbors from REASSOCIATE history APs SHOULD complete roam authentication based on PSKs before MOVE Notify

doc.: IEEE /230r0 Submission Robert Moskowitz, Trusecure/ICSALabsSlide 11 March 2002 Operation in non-11f environment List of neighbor APs hand configured –BSSIDs and IP addresses

doc.: IEEE /230r0 Submission Robert Moskowitz, Trusecure/ICSALabsSlide 12 March 2002 Discussion???