Research Article
Securing Network Location Awareness with Authenticated DHCP
@INPROCEEDINGS{10.1109/SECCOM.2007.4550359, author={Tuomas Aura and Michael Roe and Steven J. Murdoch}, title={Securing Network Location Awareness with Authenticated DHCP}, proceedings={3rd International ICST Conference on Security and Privacy in Communication Networks}, publisher={IEEE}, proceedings_a={SECURECOMM}, year={2008}, month={6}, keywords={Access protocols Authentication Communication system security Computer networks Home computing Information security Mobile computing Mobile radio mobility management Network servers Public key}, doi={10.1109/SECCOM.2007.4550359} }- Tuomas Aura
Michael Roe
Steven J. Murdoch
Year: 2008
Securing Network Location Awareness with Authenticated DHCP
SECURECOMM
IEEE
DOI: 10.1109/SECCOM.2007.4550359
Abstract
Network location awareness (NLA) enables mobile computers to recognize home, work and public networks and wireless hotspots and to behave differently at different locations. The location information is used to change security settings such as firewall rules. Current NLA mechanisms, however, do not provide authenticated location information on all networks. This paper describes a novel mechanism, based on public-key authentication of DHCP servers, for securing NLA at home networks and wireless hotspots. The main contributions of the paper are the requirements analysis, a naming and authorization scheme for network locations, and the extremely simple protocol design. The mobile computer can remember and recognize previously visited networks securely even when there is no PKI available. This is critical because we do not expect the majority of small networks to obtain public-key certificates. The protocol also allows a network administrator to pool multiple, heterogeneous access links, such as a campus network, to one logical network identity. Another major requirement for the protocol was that it must not leak information about the mobile host’s identity or affiliation. The authenticated location information can be used to minimize attack surface on the mobile host by making security-policy exceptions specific to a network location.