EAP-in-EAP Authentication Key Segmentation for Man-in-the-Middle Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The IEEE 802.16e communication system's EAP-in-EAP authentication method is vulnerable to man-in-the-middle attacks due to the generation of a single Master Session Key (MSK) during device authentication, which compromises the security and quality of service by allowing adversaries to intercept and authenticate using stolen keys.
Innovation Solution
The system employs double Pairwise Master Keys (PMKs), where both device and user authentications generate separate MSKs, with the Base Station (BS) and Authorization, Authentication, and Accounting (AAA) server using these keys to create an Authorization Key (AK) through a Dot16KDF function, enhancing security by preventing unauthorized key usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single Master Session Key (MSK) is generated during device authentication, then the authentication process is simple and efficient, but the system becomes vulnerable to man-in-the-middle attacks
Solution Approach 1:
The patent segments the single MSK into two separate MSKs: one generated during device authentication and another during user authentication. This segmentation isolates the security boundaries, ensuring that a compromise of one key does not affect the other, thereby eliminating man-in-the-middle attack vulnerabilities while maintaining manageable complexity through structured key separation.
Solution Approach 2:
The patent introduces a new dimension to key management by transitioning from a single key hierarchy to a dual key hierarchy structure. The first MSK handles device-level authentication while the second MSK handles user-level authentication, adding a dimensional layer of security that prevents lateral movement of keys and eliminates the man-in-the-middle attack surface.
2Reliability
If double Pairwise Master Keys (PMKs) are used with separate MSKs for device and user authentication, then authentication reliability increases and man-in-the-middle attacks are prevented, but the authentication process becomes more complex
Solution Approach 1:
The authentication process is segmented into distinct phases: device authentication generating the first MSK, and user authentication generating the second MSK. Each phase operates independently with its own key material, reducing the cognitive load on implementing systems while maintaining high security. The segmentation allows modular implementation of authentication logic.
Solution Approach 2:
The first MSK is generated and established during device authentication as a preliminary action before user authentication occurs. This preliminary key establishment creates a secure foundation that enables subsequent user authentication without requiring re-establishment of device-level trust, thereby simplifying the overall authentication flow despite using double PMKs.
3Object-affected harmful factors
If the Base Station and AAA server use Dot16KDF function to create Authorization Key (AK) from double PMKs, then security against key theft is improved, but computational requirements increase
Solution Approach 1:
The patent applies parameter changes by using the Dot16KDF function to derive the Authorization Key (AK) from the double PMKs through a deterministic transformation. This parameter transformation creates a derived key that is computationally efficient to generate but computationally infeasible to reverse, providing strong protection against key theft while maintaining acceptable energy consumption for mobile devices.
Solution Approach 2:
The Dot16KDF function serves as an intermediary that transforms the double PMKs into the Authorization Key (AK). This intermediary function provides a secure bridge between the key derivation process and the actual encryption operations, ensuring that the AK can be efficiently computed from the PMKs while providing cryptographic protection that prevents direct key theft attacks.
Data Source
AI summary
An authentication method and system in a communication system are provided. An MS, a BS and an AAA server acquire a first MSK by a first EAP authentication for the MS in an EAP-in-EAP scheme. After the first EAP authentication, they acquire a second MSK by a second EAP authentication for the MS in the EAP-in-EAP scheme.