Wimax standards and Security The Wimax

Network Security

The 802.16 MAC protocol specifies security procedures used to authenticate new nodes and exchange and maintain private encryption keys. The private encryption keys are used to encrypt traffic to first-hop neighbors or to the base station. We first review the authentication process during which network- wide shared secrets are distributed to mesh routers entering the mesh. We then review how private keys are exchanged between peer nodes so that
802.16 peers can encrypt data packets. Finally, we propose an end-to-end security scheme to simplify security in the mesh.

1. 
   Network Authentication
   

Before nodes can use the network, they authenticate themselves with the base station. The authentication of new mesh nodes is performed with the privacy key management (PKM) protocol [6]. The PKM protocol is also used to distribute and maintain private keys used for traffic encryption.
During network entry, the new node (candidate node) first finds a sponsor node, which provides a portion of its own bandwidth as the sponsor chan- nel. The candidate node uses the sponsor channel to authenticate with the base station (Figure 8.12). The candidate node sends a PKM-REQ packet to the authentication server, which may reside on the base station. Since the candidate node may not be directly connected to the base station, and the authentication server, the sponsor node tunnels the candidate’s PKM-REQ packet to the base station with UDP. The PKM-REQ message carries a X.509 certificate [21] belonging to the candidate node. The X.509 certificate is used to verify the authenticity of the candidate node and it also contains the can- didate’s public RSA key. If the candidate node is verified, the authentication

New node
Sponsor node
Base station
Authentication server

Open sponsor channel

Authenticate

Close sponsor channel