MMR network

In order to improve the capacity and extend coverage range in 802.16e, IEEE 802.16j task group aims to design a minimal set of function enhancement and extension for mobile multi-hop relay capability. IEEE 802.16 MMR network is that RSs help BS communicate with those MSs that are either too far away from the BS or placed in an area where direct communication with BS experiences unsatisfactory level of services. IEEE 802.16j intends to support multi-hop relay function which is in a BS and numerous RSs can form the footprint of such 802.16 networks. Therefore, it can be significantly expanded in a highly economical manner. The MMR network communication is shown in Figure 2.1. An access link is between MS and its access RS. A relay link is a wireless link that directly connects an access station, which is at the point of direct access to the network for a given MS or RS, with its attached RS.

Furthermore, an access station can be a BS or a RS. MR-BS is a fixed base station connected to the access network. Generally, RSs are categorized into fixed RS (FRS)

installed in a fixed location, nomadic RS (NRS) installed for a temporary duration where events occur and mobile RS (MRS) installed on a vehicle such as buses and trains. RS can be deployed either in planned or unplanned manner based on which access links are offered to MSs. Referring to Figure 2.1, MS2 can be served either by NRS or FRS through one of three unique paths (MR-BS→FRS1→FRS2, MR-BS→FRS1→NRS and MR-BS→NRS). In the next section we concentrate on Mobile RS (MRS), which is mounted on a vehicle, for our network model.

Figure 2.1 IEEE 802.16j Network Topology

2.1.2 Usage Model for MRS on Vehicle

MS devices travel together on a mobile vehicle, such as a bus or a train, in this usage model coverage. A mobile RS (MRS) is mounted on the vehicle and it uses a mobile link to connect to an MMR-BS or an RS. The MRS provides a fixed access link to MS devices riding on the vehicle. In this usage model RSs may enter and exit the network when the vehicle enters or exits the coverage area of the network. They may also enter the network when the vehicle is put into service and exit the network when the vehicle quits from service. For example, the first train begins to run in the

morning and the last train ends to run in the evening. In this model, topologies may include communication paths that traverse two or more hops. An example of a multi-hop topology is the case where the train travels through a tunnel and the mobile RS on the train connects to RSs that are deployed along the tunnel.

In this usage model it is expected that a MRS can provide service directly to a number of MSs that are on the vehicle, or via one or more additional RSs that are also mounted on the vehicle, as in the case of a long train. In this case the other RSs are mobile in the sense that they are moving on the vehicle, but they are fixed relative to each other. Therefore, for different scenarios a station may be able to operate as either a BS or RS and may need to switch roles in response to conditions in the field such as an RS losing connectivity to its upstream RS or MMR-BS.

2.2 Handover Protocols

In this section we state MRS handover which is relevant to our scheme. We simply describe mobile IP and depict fast mobile IPv6 protocol in predictive mode and reactive mode.

2.2.1 MRS Handover

IEEE 802.16j defines a handover process that MS or MRS needs to change the BS for higher signal quality or better QoS when it moves. The handover procedures can be decomposed into three phases: handover preparation, handover decision and initiation, and handover execution. The handover procedures of MRS are illustrated in Figure 2.2.

MRS Serving BS Target BS

Figure 2.2 Handover procedures of MRS

The handover preparation phase includes network topology advertisement, scanning, and association procedure. During network topology advertisement procedure, a BS needs to broadcast information regarding the network topology through MOB_NBR-ADV message. The purpose of the message is to provide a MRS with the current network identification and information about neighboring BSs, and to facilitate MRS synchronization with neighboring BSs. According to this information, the MRS can make an immediate decision for a future handover. If necessary, a MRS may perform a scanning procedure to find and monitor the suitable neighboring BSs as a target BS. Association procedure is an optional and initial ranging procedure occurred during the scanning interval with respect to one of the neighbor BSs. The handover decision and initiation begin when a MRS needs the handover from serving BS to target BS by sending a MOB_MSHO-REQ message. After receiving MOB_MSHO-REQ message, the serving BS replies MOB_BSHO-RSP message with recommended target BSs to the MRS and sends the MAC addresses and CIDs of the MSs under MRS to these target BSs through the backbone network. Afterward, handover execution occurs. The MRS selects the target BS and sends MOB_HO-IND

message to indicate a handover to the serving BS. After MRS sent MOB_HO-IND message, no packet transfer between the MRS and the serving BS is allowed. Then, MRS performs downlink synchronization, ranging, and network re-entry to the target BS. The target BS assigns new CIDs for MSs and sends it to MRS and then MRS creates mapping between old and new CID for each MS. After handover execution phase, the target BS becomes the serving BS and starts to provide service to the MRS.

2.2.2 Mobile IP

In the current network, both communication ends use IP address. If one side of communication alters the network domain, it will change the IP address, and the link would be interrupted, therefore it must reconnect to the network. We need a technology to help us transform IP address. The technique of mobile IP is developed to solve this problem in IPv4 architecture. With Mobile IP [6], as shown in Figure 2.3, it is unnecessary that a MS needs to change the address and causes interruption with correspondent node due to moving to a different network domain.

Figure 2.3 Mobile IP

A MS uses a home address (HA), which means a fixed IP, to represent itself.

When the MS moves to other network domain, it will obtain a care of address (CoA) from the foreign agent. Then, it may have a registration to link between HA and CoA.

The packets delivered to HA in local network is sent to home agent and then transferred to MS through the relation of HA and CoA. Through the CoA register technique, MS still can use HA to receive data with correspondent node even though it is not in home network.

2.2.3 Fast Mobile IPv6

Fast Mobile IPv6 (FMIPv6) [7] is defined to reduce the handover latency for the real-time traffic by movement detection and address configuration procedures. When MS moves to other network domain and changes to a new subnet, FMIPv6 enables a MS to quickly detect its entering to a new subnet and perform CoA configuration early by providing the subnet network prefix information of associated access router (AR). Figure 2.4 shows the FMIPv6 handover procedures.

NAR

Figure 2.4 FMIPv6 in predictive mode

After discovering a new neighbor BS, MS may perform scanning in order to determine the BSs that are available. Then, it selects one of the candidate BSs and obtains a new subnet prefix of the target BS by exchanging the RtSolPr message and PrRtAdv messages with previous AR (PAR). Upon receiving PrRtAdv message, the MS configures its CoA based on the subnet prefix obtained from the message.

When MS decides an impending handover, it notifies the router that there is a binding between previous CoA at the current subnet and new CoA at the target subnet by sending a FBU message to the PAR. Afterward, the PAR sends HI message to the new AR (NAR) for CoA confirmation procedure. After NAR receives HI message, it executes the CoA confirmation, duplicate address detection (DAD) procedure, and replies HAck message to the PAR. At the same time, the tunnel between the previous CoA of MS and its new CoA at the NAR is established.

The NAR receives the tunneled packets and stores them in a buffer until it receives FNA message from the MS. Then, it delivers the buffered packets to the MS.

The FNA message is sent after the MS conducts handover to the target BS and performs the network re-entry procedure. On receiving HAck message, PAR sends FBAck message to the MS. If the MS receives this message before its handover and sends MOB_HO-IND message as a final indication of handover, the predictive mode of FMIPv6 is enabled. The predictive FMIPv6 makes the MS to move to the new subnet and receive packets from the NAR quickly.

However, if the MS does not receive FBAck message before it is forced to move to the new subnet, reactive mode will occur. In reactive mode, the MS has to wait for packet rerouting to be executed then it can receive packets from the NAR. Figure 2.5 shows the FMIPv6 in reactive mode.

Figure 2.5 FMIPv6 in reactive mode

2.3 Authentication Mechanism

In this section we describe the authentication mechanism of IEEE 802.16.

Section 2.3.1 introduces authentication architectures of client and backhaul. Section 2.3.2 states EAP-TLS authentication procedures. Section 2.3.3 describes the derivation of MSK, PMK, and AK in EAP-TLS method.

2.3.1 Authentication architecture

IEEE 802.16e defines security sub-layer to supply the service of privacy, authentication and confidentiality for security of MS in wireless communication. The security architecture platform and privacy key management protocol (PKM) in security sub-layer is shown in Figure 2.6 [2]. There are some different authentication mechanisms on PKM platform. They allow BS and MS to perform single or double authentication. IEEE 802.16 provides two authentication mechanisms, RSA and EAP,

NAR MS PAR

RtSolPr PrRtAdv

FBU

FNA[FBU]

Tunnel Disconnect

Connect

FBU FBAck

which are algorithms for public-key cryptography. The purpose of PKM is to assist MS and BS in generating a shared secret key, i.e. authentication key (AK). And they use the AK to protect the traffic encryption key (TEK) requested for data encryption.

Figure 2.6 Security sub-layer

Private key management provides a secure key exchange mechanism. It also supports periodic authentication and key update. To improve and correct the leak of security in PKMv1, PKMv2 is proposed in IEEE 802.16e. As shown in Figure 2.7, MS is a supplicant that will enable the authentication procedures and transmit authentication packets through EAP mode in PKMv2. EAP protocol is generally constructed on AAA Server for storage of authentication information. A BS receiving the authentication packets only needs to relay the packets to authenticator which is put with ASN gateway. Then, the authenticator sends the packets to AAA through RADIUS. And AAA will check whether the supplicant is a legal user or not. The MS can use the WiMAX after AAA certificates it.

Figure 2.7 WiMAX authentication architecture

2.3.2 EAP-TLS

EAP provides a standard mechanism for supporting various authentication methods over wired and wireless networks. EAP-TLS is an EAP-Method defined in RFC 2716 [8]. It uses a certificate to authenticate, in other words, a MS must acquire a certificate from Certification Authority in the network before it uses the EAP-TLS authentication service. The complete authentication procedures are described as follows and Figure 2.8 illustrates these procedures.

1. When a MS links up with BS, the MS sends EAP-Start message to request EAP-TLS authentication.

2. The NAR sends an EAP-Request message to MS for requesting MS’s EAP-identity. The MS answers with an EAP-Response message including its identity. Then, the NAR relays this information to AAA.

3. AAA responses TLS-Start message in an EAP-Request message and the TLS-Handshake begins.

Figure 2.8 EAP-TLS authentication procedures

4. The MS sends the Client-Hello message in an EAP-Response message to AAA.

The Client-Hello message includes a random number that guarantees the freshness of the resulting keys to MS.

5. AAA answers with an EAP-Request message including the TLS messages (Server-Hello, Server-Certificate, …). On receipt of these messages, the MS generates a MSK.

6. The MS sends an EAP-Response message including the TLS messages (Client-Certificate, ...). And then AAA generates the MSK using the same method as MS.

7. The EAP-TLS protocol ends with an EAP-Success message sent from AAA to MS. AAA transfers the MSK to ASN through RADIUS. According to the

algorithm defined in IEEE 802.16e, MS and AAA compute the PMK by using the MSK. And then they compute the AK by using PMK. Then, the ASN transmits the AK and relevant parameters to BS.

8. If the BS obtains the AK, it will send SA-TEK Challenge message including authentication information, such as X.509 certificate, to SS. Then, MS responses authorization request message to BS. The BS certifies the identity of MS and then sends authorization reply message including encrypted AK. Upon receiving the encrypted AK, the MS decrypts the AK.

9. After performing PKMv2 three-way-handshake protocol to confirm the AK, MS and BS can use the AK synchronously. The MS has Traffic Encryption Key (TEK) exchange with BS each time for security association. First the MS sends key-request message to BS. The BS certifies HMAC-Digest by SHA1 algorithm [9] and generates TEK. Then, it encrypts the TEK by Key Encryption Key (KEK) generated from AK and responses key-reply message to MS. On receiving the message, MS also certifies HMAC-Digest by SHA1 algorithm and then decrypts the TEK by Key Encryption Key (KEK) generated from AK

2.3.3 Key Derivation

Figure 2.9 [2] shows the key generation and evolution processes. After EAP authentication succeeded, MS and AAA generate a 512-bit MSK by using pseudo random function (formula 1). They truncate 160 bit of the MSK and then generate an AK by putting the PMK into key distribution function (formula 2). Traffic Encryption Key (TEK) is derived as a random number. Also, Key Encryption Key (KEK) and HMAC key are generated by AK using formula 3.

Figure 2.9 Key generation and evolution process

MSK=PRF(SecurityParameters.master_secret, "ttls keying material",

SecurityParameters.client_random + SecurityParameters.server_random) (1) AK = Dot16KDF(PMK, SSID || BSID || AKID || PAK || “AK”, 160), (2) HMAC_KEY_U || HMAC_KEY_D || KEK <= Dot16KDF(AK, SSID || BSID ||

“HMAC_KEYS+KEK”, 448). (3)

2.4 Related Works

In this section, we introduce some related works for our thesis. Section 2.4.1 describes the previous work on which our proposed scheme is based. Then in Section 2.4.2, we introduce the related works about pre-authentication.

2.4.1 A Fast Handover Mobility Scheme over 802.16j Moving RS Mode[5]

According to the previous description, a MS which moves to another BS and changes the subnet must perform link layer and network layer handover procedures.

However, the MS detects that it has been moved to a different subnet after the MRS

performed link layer network re-entry on 802.16j. Then, it performs network layer handover procedures, such as Mobile IPv6. Figure 2.10 describes the conventional handover latency and total disruption time for network layer handover on 802.16j and using Mobile IPv6. In this case, the handover disruption time is significant.

Figure 2.10 Conventional handover procedures with Mobile IPv6

Due to the problem described above, we introduce a mobility scheme to improve this problem. It is based on the mobile vehicle usage model over IEEE 802.16j that is compatible with FMIPv6. Link layer handover is performed by MRS while network layer handover is performed by MS in this network model. This scheme proposes that a MRS and a MS using MAC management messages transmission to accomplish link layer and network layer handover procedures are performed concurrently to reduce the service disruption time. The scheme is shown in Figure 2.11.

Figure 2.11 The scheme in predictive mode (left) and reactive mode (right)

The dot lines represent the MAC layer handover procedures and the solid lines represent the network layer handover procedures. A completed description of message transmission is depicted in the next chapter. In the following we introduce the four messages proposed in the related works.

1. A MRS generates the MRS_NBR-ADV message according to the information in MOB_NBR-ADV message and sends to MS as an advertisement of the BS information next to it.

2. After the handover initiation, the MRS notifies MS that the target BS belongs to a different subnet by sending MRS_HO-REQ message.

3. When the MS finishes the CoA confirmation procedure and receives FBAck message, it will send MRS_HO-RSP message to MRS. If some MSs has not sent this message and the MRS needs to execute the handover immediately, it may cause some MSs to perform handover in predictive mode and others to perform

handover in reactive mode.

4. After the MAC layer network re-entry, MRS informs MS that it has linked with target BS and MS can deliver/receive packets to/from NAR.

The author compares this handover scheme to conventional handover and shows the cartogram in Figure 2.12. The handover disruption time is reduced to about 200 ms which is layer 2 network re-entry processing time.

Figure 2.12 Disruption time in proposed scheme and conventional scheme

The handover disruption time is the major impact to communications quality or QoS. Therefore, we try to reduce the network re-entry processing time by pre-authentication scheme to improve the previous scheme. Next we introduce some related works about pre-authentication mechanism.

2.4.2 Pre-authentication Mechanism

Recently, Kassab et al. proposed a fast pre-authentication scheme [10] for IEEE 802.11 networks based on proactive key distribution. This scheme reduces the

0 200 400 600 800 1000 1200 1400

Conventional Scheme Scheme of [5]

Disruption Latency

handover latency by reducing the steps of EAP-TLS and computing necessary key material between MSs and BSs in advance. For IEEE 802.16e, Sun et al. proposed a Secure and fast handover scheme [11]. Due to flexibility and security, the proposed scheme is combined with the Public Key Infrastructure. It provides a secure and fast re-authentication procedure during macro-handover, which means a MS moving from one ASN to another ASN can still be authenticated since two ASN gateways are in the same CSN. In the future, integrated WiFi and WiMAX network has great potential due to the high data transport capacity of WiFi and the wider coverage of WiMAX.

Hou et al. proposed a pre-authentication architecture [12] based on EAP-TLS protocol.

The authentication delay can be significantly reduced when a MS roams between WiFi and WiMAX.

Chapter 3 Proposed Scheme

The proposed scheme and its corresponding MAC management messages to reduce the system disruption time are described in this chapter. Section 3.1 and Section 3.2 present a network model and the new MAC management messages used in the proposed scheme respectively. Section 3.3 describes the procedure of our proposed pre-authentication scheme.

3.1 Network Model

We propose a scheme based on the network model of [5], which is IEEE 802.16j vehicle usage model compatible with FMIPv6. In this model, a MRS can be mounted on mobile vehicles, such as a bus or a train, with several MS which are regarded as mobile devices used by passengers. The network model is shown in Figure 3.1. The MSs connect to network through MRS on the vehicle and move together with MRS,

We propose a scheme based on the network model of [5], which is IEEE 802.16j vehicle usage model compatible with FMIPv6. In this model, a MRS can be mounted on mobile vehicles, such as a bus or a train, with several MS which are regarded as mobile devices used by passengers. The network model is shown in Figure 3.1. The MSs connect to network through MRS on the vehicle and move together with MRS,