# INTRODUCTION iFi (Wireless Fidelity) networks based on IEEE 802.11 standard [1] are being widely deployed in different environment due to standardization and ease to use as well as low cost. However, this deployment is limited to hotspots, homes, offices, public zone including airports, etc. due to the limited coverage of Wi-Fi propagation and high cost of installing and maintaining a wired network backhaul connection [17][18]. An extension of the IEEE 802.11 standard known as 802.11s to achieve mesh networking is under specification and not finalized yet represents the proposed architecture and the main functional entities [20]. In section III, we investigate the AAA and security issues and we describe the solution adopted in our architecture to achieve a secure service and protection against attacks. Finally, section IV concludes the paper. # II. # USER AUTHENTICATION User authentication can be based on a variety of authentication mechanisms such as Username/password, Universal SIM (USIM) and removable user identity Module (RUIM), etc. We will describe the authentication procedures for both user type A and user type B. # User Type A: After completing the PMP Network Entry process & capabilities negotiation [6] [20], user type A starts the authentication process, based on PKM-EAP recommendations as follows: ? In order to initiate the EAP conversation, a user type A may send PKMv2-EAP-start message (Figure 3). Fig3 : User type A Authentication procedure # User Type B: To obtain Internet access, a user first completes the network discovery process & sends an associate request to an AP. After the reception of an associate response, user type B starts the authentication process, based on WPA2 recommendations, by sending user authentication information (ex: user name & password), in order to be allowed to use network resources. To get a better idea of how the authentication will operate, the interactions between elements are illustrated in the diagram of Figure 4: ? The user type B send an EAP-start message. ? The AP replies with an EAP-request identity message. ? The user type B sends an EAP-response packet containing the identity to be sent to the authentication server [22]. In a secure environment, the AP, MBS and CBS forward this information to the authentication server [20]. Fig4 : User type A Authentication procedure ? The authentication server using a specific authentication algorithm verifies the user's identity [7]. This could be through the use of digital certificates or other EAP authentication type [7]. ? The authentication server will either send an acceptation (or reject) message to the AP. Then the AP sends an EAP-success packet (or fail) message to the user type B [7]. ? If the authentication server accepts the user type B, the AP will transit the user type B's port to an authorized state & forward additional traffic. This is similar to the AP automatically opening the gate to let in only people belonging to the group cleared for entry. In this procedure for user type B, all BS's are merely a secure conduit for the AAA messages & does not play a significant role in the AAA process. # III. SECURE AUTHENTICATION PROCESS BY USING HASH FUNCTION The security steps are as follows: Step 1: Client request for communication & send out a string as a challenge to A.P. Step 2: A.P also sends out a string as a challenge to the Client. Key Agreement & Authentication Protocol for IEEE 802.11 Step 3: Client & AP both calculate their corresponding string. and send the message digest value to the 2 nd Hash function. Fig5 : Authentication in secure way using Hash Function Step 4: Both calculates the message digest for the corresponding string & send to each other. Only the legitimate A.P And Client knows the hash algorithm. But the evil M.S is not able to produce correct value for the given string. Step # IV. SECURE AUTHENTICATION PROCESS BY USING MATH FUNCTION The security steps are as follows: Step 1: Client request for communication & send out a number as a challenge to A.P. Step 2: A.P also sends out a number as a challenge to Client. Step 3: Client calculates the value of the number by applying Math function And sends the challenging value and its ISSI number to A.P. Fig6 : Authentication in secure way using Math Function # WPA2 KEY GENERATION # FUNCTION LIBRARY Handshake is accomplished by four EAPoL-Key messages between the client & the AP is initiated by the access point & performs the following tasks: ? Confirm the client's knowledge of the PMK. The PMK derivation, required to generate the PTK, is rely on the authentication method used. In WPA2 Personal mode, the PMK is derived from the authentication PSK & for WPA2 Enterprise mode the PMK is derived from the authentication MK [1] (key hierarchy in Fig. 7). # KEY HIERARCHY # KEY AGREEMENT ALGORITHM To establishing shared secret between M.S & B.S, both must agrees on public constants p & g. where p is a prime number & g is the generator less than p [17]. Step 1: Let x and y be the private keys of M.S & B.S respectively. Private keys are random number, less than p. Step 2: Let gx mod p and gy mod p be the public keys of devices M.S & B.S respectively Step 3: M.S and B.S exchanged their public keys. Step 4: The end M.S computes (gy mod p)x mod p, which is equal to gyx mod p. Step 5: The end B.S computes (gx mod p) y mod p, which is equal to gxy mod p. Step 6: Since, K = gyx mod p=gxy mod p, shared secret = K. # a) Mathematical Explanation-Dh From the properties of modular arithmetic, x mod n * y mod n ? x * y ( mod n) . We can write: (x 1 mod n)*(x 2 mod n)*? *(x k mod n) ? x 1 * x 2 * ?* x k ( mod n), if x i =x, where i = 1, 2, 3? k (x mod n)k ? x k mod n , (gx mod p)y mod p = gxy mod p & (gy mod p)x mod p = gyx mod p, For all integers gxy=gyx, Therefore shared secret K=gxy mod p=gyx mod p [17]. Since, it is practically impossible to find the private key x or y from the public key [17] gx mod p or gy mod p, it is impossible to obtain the shared secret K for a attacker [17]. b) One-way function in DH For M.S, Let x be the private key and a = gx mod p is the public key, Here, a = gx mod p is one-way function [17]. The public key a is obtained easily in the forward operation, but finding ?x' given a, g and p is the reverse operation & it will take exponentially longer time and is practically impossible. This is called discrete logarithm problem [17]. i. ECDH -elliptic curve diffie-hellman ECDH: a variant of DH, is a key agreement algorithm. To generate a shared secret between M.S and B.S using ECDH [14] [17], both have to agree up on Elliptic Curve domain parameters. An overview of ECDH is given below. dY*QX = L, Hence, K = L, therefore aK = aL Since it is practically not possible to find the private key dX or dY from the public key QX or QY, it is impossible to obtain the shared secret for a third party [17] [16]. ii. RSA It is a public key algorithm, which is used for Encryption, Signature and Key Agreement. It (RSA) typically uses keys of size 1024 to 2048 [17]. The RSA standard is specified as RFC 3447, RSA cryptography Specifications Version 2.1 [17]. Overviews of RSA algorithms are given below. Step 2: Find n=a*b, Where n is the modulus which is made public. The length of n is considered as the RSA key length [17]. Step 3: Choose a random number ?e' as a public key in the range 0