1. Kerberos5 with Mobile Agent Service Authenticator (MASA) By: Poonam Gupta Sowmya Sugumaran 1

2. Problem Statement Our goal is to ensure that authenticated mobile users receive the services without interruption and with less overhead and delay 2

3. Mobility Services Network Layer Mobility – ensures connection for mobile users Service Layer Mobility – ensures services for mobile users 3

4. Modification to Our Proposal Proactively acquiring TGT and service tickets in realms to be visited 4

5. Motivation and Example Realms - consists of clients, KDC, Server application Clients can get the service from different realm in cross-realm authentication without having an account to different realm 5

6. Motivation and example continued Student wants to print a file from dept a to dept b Without cross-realm mechanism user will have to an account in each realm and transfer file between each realms to print a file With our scheme service ticket to print a file can be achieved proactively by exploiting the use of cross-realm mechanism and knowledge of mobility 6

7. No-Cross-Realm(NCR) Message Exchange for Realm1 for Mobile Users 1) Client ---C, TGT--------------------------------> AS 1 2) Client <------{T C,tgs, K c,tgs }K c ----------------AS 1 3) Client -------T c,tgs, S-------------------------> TGS 1 4) Client <---------{T c,s, K c,s, }K c,tgs ------------TGS 1 5) Client-----------{T c,s } K cs, A c ------------->Server 1 7

8. NCR Message Exchange for mobile users for Realm2 1) Client ---C, TGT--------------------------------> AS 2 2) Client <------{T C,tgs, K c,tgs }K c ----------------AS 2 3) Client -------T c,tgs, S-------------------------> TGS 2 4) Client <---------{T c,s, K c,s, }K c,tgs ------------TGS 2 5) Client-----------{T c,s } K cs, A c ------------->Server 2 8

9. Message Exchange Steps for different realms service for mobile users with cross-realm 1) Client ---C, TGT or RTGT --------------------> AS 2) Client <------send TGT or RTGT-----------AS 3) Client -------send TGTorRTGT,Service----->TGS 4) Client <---------Service Ticket ------------TGS 5) Client---Service Ticket------------ ->Server 9

10. Difference With cross-realm mechanism Exchange of messages are same Get the service ticket when you need it combining cross-realm mechanism and our scheme Exchange of messages are same Get the service ticket proactively 10

11. Kerberos V4 Cross-Realm Authentication Ticket Flow Tutorial Slide from Jourge Cuellar 11

12. Kerberos 5 Allows for trusted path Hierarchical Realm Non-hierarchical (shortcuts) 12

13. Our Scheme: MASA Mobile Agent Service Authenticator (MASA): A software agent on the mobile client to assist with proactively acquiring authentication (TGTs) from to-be-visited realms. User App -> MASA -> Kerberos(AS, TGS) MASA knows mobile user’s: – profile (preferences) – mobility pattern 13

14. Comparison (Handling Mobile Users) No Cross-Realm Scheme (NCRS): – Requires user account in each visited realm – User needs to be authenticated in each realm Reactive Cross-Realm Scheme (RCRS): – User can acquire TGT for to-be-visited realm from registered Realm – Reactive: acquires service ticket at the time of service MASA: – Uses Cross realm mechanism Reduces number of messages (overhead) – Proactive: acquires TGT and service ticket before the service request Reduces latency 14

15. MASA Implementation: Basic Idea Event based Assume network layer mobility events can be mapped to Realm layer mobility events Service Table: services needed by user in each Realm he visits Upon Move_to_Realm_Warning(R next ) – get TGT for R next using cross-realm mechanism in R home – Get service ticket from TGT from R next for each service needed from R next 15

16. MASA Implementation: Detail R home MASA Server Mobile User MASA Client Initial log on Get ticket from home R current R next Cross-Realm Mobile User MASA Client TGT_next Servicenext Move to R_next 16

17. MASA Implementation: Comments Client-Server Architecture MASA – client is light weight MASA – Server maintains user profile and maintain mobility data Reduce message generated by Mobile client – Saves wireless bandwidth – Saves mobile energy 17

18. MASA Cost Analysis f c : frequency service (call) request f m : frequency of moves (change of realm) CMR (Call-to-Mobility Ratio): Cost: Either Number of Messages or Latency Normalized Cost = f c (cost of each service request) + f m (cost incurred on each move) Find CMRs for which Cost MASA < Cost old_scheme 18

19. MASA Cost Analysis Continued Consider Only message generated by mobile a: cost of long distance message compared to local message Cost ncrs = 2f m + 3*f c Cost masa = 2af m + a*f c MASA is better if Costmasa < Cost ncrs – i.e. CMR > 2(a-1)/(3-a) – If a == 1 then for CMR >0 MASA better than NCRS – If a==2 then for CMR > 2 MASA better than NCRS 19

20. Installing OpenAFS for Windows Select the 64-bit EXE installer for Windows Select a location to install OpenAFS In CellServdB, delete all other contents except that of the required domains(eg:asu.edu) In the Client cell name configuration window, set the AFS cell name to asu.edu 20

21. After Installation Ticket manager will start upon login and display a ticket initialization window Initialize the ticket using the Network ID If successful, the ticket and tokens can be viewed by clicking on the Kerberos icon. 21

22. 22

23. 23

24. 24

25. MASA Emulation Using Java Kerberos 1.1 25 Running Java Kerberos to Acquire Service Ticket Realm1: PNM.PG Running Java Kerberos to Acquire Service Ticket Realm2:PNM2.PG User used TGT to get Service Ticket For Realm2 Successfully authenticated By Realm2

26. 26

27. 27

28. 28

29. 29

30. 30

31. 31

32. 32

33. 33

34. 34

35. 35

36. 36

37. Many thanks to Dr. Dijiang Huang Our classmates Wenzhe Jiao 37

38. References: ftp://ftp.cis.upenn.edu/pub/papers/scedrov/k 5cr.pdf ftp://ftp.cis.upenn.edu/pub/papers/scedrov/k 5cr.pdf http://www2.imm.dtu.dk/courses/02345/Lab 4/krb5-UserGuide-1.1.pdf http://www.isoc.org/isoc/conferences/ndss/9 9/proceedings/papers/wu.pdf http://www.isoc.org/isoc/conferences/ndss/9 9/proceedings/papers/wu.pdf http://kickjava.com/src/javax/security/auth/k erberos/KerberosPrincipal.java.html 38

39. Thank You…!!! 39