Performance evaluation of IKEv2 authentication methods in next generation wireless networks

Abstract

Secure communications have a key role in future networks and applications. Information security provisions such as authorization, authentication, and encryption must be added to current communications protocols. To accomplish this, each protocol must be reexamined to determine the impact on performance of adding such security services. This paper presents an experimental evaluation of the performance costs of a wide variety of authentication methods over IKEv2 in real and partly emulated scenarios of next generation wireless networks. The studied methods are pre-shared keys (PSKs), extensible authentication protocol (EAP) using MD5, SIM, TTLS-MD5, TLS, and PEAP-MSCHAPv2. For the EAP-based methods, RADIUS is used as the authentication, authorization, and accounting (AAA) server. Different lengths of certificate chains are studied in case of the TLS-based methods, i.e., TTLS-MD5, TLS, and PEAP-MSCHAPv2. The paper first presents a brief overview of the considered authentication methods. Then, a comparison of the costs for message transfers and computations associated with the authentication methods is provided. The measurement results are verified through a simple analysis, and interpreted by discussing the main contributing factors of the costs. The measurement results illustrate the practical costs involved for IKEv2 authentication, and the implications of the use of different methods are discussed. compose application services. They allow mobile users to engage in all kinds of Internet transactions and services with appropriate trust and security relationship management. One of the main issues on the connectivity level is how to seamlessly integrate the heterogeneous RANs and to realize two major functionalities on top of these networks. The two PERFORMANCE EVALUATION OF IKEv2 AUTHENTICATION METHODS 85 WiFi. The initiator and the responder communicate over an IEEE 802.11g WiFi RAN using IPv6. UMTS. The initiator has native IPv6 access to the responder over an UMTS test network. Far-close. This scenario is an extension of the WiFi scenario. It emulates a situation where the initiator

Impact of Slow Start on SCTP Handover Performance

“…However, with message sizes in the order of 10 KBytes and RTTs approaching 200 ms, the impact becomes quite significant. In fact, the figure predicts that some messages in a video flow (e.g., frames of size 30 KBytes that are transmitted at a frame rate of 30 frames/s) over a 3G wireless link with an RTT of 200 ms [25] experience delay penalties in the vicinity of 1 s.…”

VIKE: vehicular IKE for context-awareness

“…At the hand of the optimization on IKEv2, Faigl et al [29] presented an experimental evaluation on the overhead of a wide variety of the authentication methods over IKEv2 in a practical and partly emulated scenario of the next generation wireless network. Cremers [8] used an adversary model to provide an extensive formal analysis of IKEv2 and found its several weaknesses.…”

IKE vulnerability discovery based on fuzzing

“…IKE protocol is chosen as the target because it plays an important role in the network. For example, many researchers have been studying on security analysis , vulnerability detection , and performance evaluation of the IKE protocol. Furthermore, the statistical data extracted from the authoritative database National Vulnerability Database indicate that 82 IKE vulnerabilities have been released up to August 2011.…”

“…The vulnerabilities consist of 36 high‐risk vulnerabilities, 45 medium‐risk vulnerabilities, and one low‐risk vulnerability. Thus, many researchers have been studying on security analysis , vulnerability discovery , and performance evaluation of IKE protocol. This paper explores the prompt discovery of vulnerabilities so as to prevent damages efficiently.…”