PKM Version 2: Three-Way Handshake

The AK can be derived in one of the three different ways depending on the authentication scheme used. Before the three-way handshake begins, both the BS and SS derive a shared KEK and the HMAC/CMAC keys. The PKMv2 three-way handshake sequence proceeds as follows.

1. During the initial network entry or reauthorization, the BS sends PKMv2 SA-TEK-Challenge (including a random number BS_Random) to the SS after protecting it with the HMAC/CMAC tuple. If the BS does not receive PKMv2 SA-TEK-Request from the SS within SAChallenge-Timer, it resends the previous PKMv2 SA-TEK-Challenge up to SAChallengeMaxResends times. If the BS reaches its maximum number of resends, it initiates another full authentication or drops the SS.

2. If HO Process Optimization Bit #1 is set, indicating that PKM authentication phase is omitted during network re-entry or handover, the BS begins the three-way handshake by appending the SAChallenge tuple TLV to the RNG-RSP. If the BS does not receive PKMv2 SA-TEK-Request from the MS within SaChallengeTimer (suggested to be several times greater than the length of SaChallengeTimer), it may initiate full reauthentication or drop the MS. If the BS receives an initial RNG-REQ during the period that PKMv2 SA-TEK-Request is expected, it shall send a new RNG-RSP with another SaChallenge TLV.

3. The SS sends PKMv2 SA-TEK-Request to the BS after protecting it with the HMAC/CMAC. If the SS does not receive PKMv2 SA-TEK-Response from the BS within SATEKTimer, it must resend the request. The SS may resend the PKMv2 SA-TEK-Request up to SATEKRequestMaxResends times. If the SS reaches its maximum number of resends, it must initiate another full authentication or attempt to connect to another BS. The SS includes, through the security negotiation parameters attribute, the security capabilities that it included in the SBC-REQ message during the basic capabilities negotiation phase.

4. Upon receipt of PKMv2 SA-TEK-Request, the BS confirms that the supplied AKID refers to an AK that is available. If the AKID is unrecognized, the BS ignores the message. The BS also verifies the HMAC/CMAC. If the HMAC/CMAC is invalid, the BS ignores the message. The BS must verify that the BS_Random in the SA TEK Request matches the value provided by the BS in the SA Challenge message. If the BS_Random value does not match, the BS shall ignore the message. In addition, the BS must verify the SS's security capabilities encoded in the security negotiation parameters attribute against the security capabilities provided by the SS through the SBC-REG message. If security negotiation parameters do not match, the BS should report the discrepancy to higher layers.

5. Upon successful validation of the PKMv2 SA-TEK-Request, the BS sends PKMv2 SATEK-Response back to the SS. The message includes a compound TLV list each of which identifies the primary and static SAs, their SA identifiers (SAID), and additional properties of the SA (e.g., type, cryptographic suite) that the SS is authorized to access. In case of HO, the details of any dynamic SA that the requesting MS was authorized in the previous serving BS are also included. In addition, the BS must include, through the security negotiation parameters attribute, the security capabilities that it wishes to specify for the session with the SS (these will generally be the same as the ones insecurely negotiated in SBC-REQ/RSP). Additionally, in case of HO, for each active SA in previous serving BS, corresponding TEK, GTEK, and GKEK parameters are also included. Thus, SA_TEK_Update provides a short-hand method for renewing active SAs used by the MS in its previous serving BS. The TLVs specify SAID in the target BS that shall replace active SAID used in the previous serving BS and also "older" TEK-parameters and "newer" TEK-parameters relevant to the active SAIDs. The update may also include multicast/broadcast Group SAIDs (GSAIDs) and associated GTEK parameter pairs. In case of unicast SAs, the TEK-parameters attribute contains all of the keying material corresponding to a particular generation of an SAID's TEK. This would include the TEK, the TEK's remaining key life-time, its key sequence number, and the CBC IV. The TEKs are encrypted with KEK. In case of group or multicast SAs, the TEK-parameters attribute contains all of the keying material corresponding to a particular generation of a GSAID's GTEK. This would include the GTEK, the GKEK, the GTEK's remaining key lifetime, the GTEK's key sequence number, and the CBC IV. The type and length of the GTEK is equal to the ones of the TEK. The GKEK should be identically shared within the same multicast group or the broadcast group. Contrary Key-Update Command, the GTEKs and GKEKs are encrypted with KEK because they are transmitted as a unicast here. Multiple iterations of these TLVs may occur suitable to recreate and reassign all active SAs and their (G)TEK pairs for the SS from its previous serving BS. If any of the SA parameters change, then those SA parameters encoding TLVs that have changed will be added. The HMAC/CMAC is the final attribute in the message's attribute list.

6. Upon receipt of PKMv2 SA-TEK-Response, an SS verifies the HMAC/CMAC. If the HMAC/CMAC is invalid, the SS ignores the message. Upon successful validation of the received PKMv2 SA-TEK-Response, the SS installs the received TEKs and associated parameters appropriately. The SS also must verify the BS's security negotiation parameters of TLV encoded in the security negotiation parameters attribute against the security negotiation parameters of TLV provided by the BS through the SBC-RSP message. If the security capabilities do not match, the SS should report the discrepancy to upper layers. The SS may choose to continue the communication with the BS. In this case, the SS may adopt the security negotiation parameters encoded in SA-TEK-Response message.

Handover Process | WiMAX Mobility Management

According to the scope of node movement, mobility can be divided into micro-mobility and macro-mobility. On the link layer, most access networks provide mobility by having an access router keep track of the specific AP to which a MS is attached. The localized mobility between pico-cells (probably heterogeneous cells) in the same subnet and the mobility between subnets in one domain is called micro-mobility, whereas the mobility between domains in wide-area wireless networks is called macro-mobility. The mobility solutions like Mobile IP are classified as macro-mobility. But Mobile IP is not suitable for micro-mobility due to its signaling overhead, handover latency, and transient packet loss.

1 Hard Handover and Soft Handover

Hard handover is mandatory to be supported in mobile WiMAX networks. Hence, break-before-make operations may happen during the handover process. In other words, link disconnection may occur and throughput may degrade. Therefore, various levels of optimization are demanded to reduce association and connection establishment with the target BS. These optimization methods are not clearly defined in the IEEE 802.16e specification, so they should be supported on specific WiMAX systems and products.

On the contrary, soft handover is optional in mobile WiMAX networks. Two schemes, macro-diversity handover (MDHO) and fast Base Station switching (FBSS) are supported. In case of MDHO, MS receives from multiple BSs simultaneously during handover, and chooses one as its target BS. As for FBSS, the MS receives from/transmits to one of several BSs (determined on a frame-by-frame basis) during handover, such that the MS can omit the decision process of selecting the target BS to shorten the latency of handover.

2 MAC Layer Handover Procedure

The handover procedure in IEEE 802.16e-2005 is divided into MAC- and PHY-layer handover. Looking at the MAC-layer handover procedure, it is divided into the network topology acquisition phase and the handover process phase according to its performing sequence.

In the network topology acquisition phase, as illustrated in Figure 1, three functions are performed, namely network topology advertisement, MS scanning for neighboring BSs, and association procedure. After receiving a neighbor advertisement message broadcast from the serving BS, the MS gets all the neighboring BSs of its current serving BS. The MS can then perform synchronization with each neighboring BS, and then continue to the handover process phase.

Figure 1: Network topology acquisition phase for handover.

Figure 1: Network topology acquisition phase for handover.

During the handover procedure, the process includes handover decision, handover initiation, and ranging procedures, followed by authorization and registration procedures. These procedures include cell reselection, handover decision and handover initiation, synchronization with new DL, acquisition of UL parameters, ranging, MS reauthorization, reregistration, and termination with the serving BS. These are shown in Figure 2 and Figure 3.

Figure 2: Handover decision, handover initiation, and ranging procedures.

Figure 3: Authorization and registration procedure.

When the MS migrates from its serving BS to its target BS, the following process is executed. First, the MS conducts cell reselection based on the information obtained from the network topology acquisition stage. The handover decision and the handover initiation can be originated by both MS and BS using the MOB_MSHO-REQ/MOB_BSHO-REQ message. When the target BS is decided, the MS sends a MOB_HO-IND message to the serving BS and the actual handover process begins as illustrated in Figure 2.

In the ranging process, the MS can synchronize to the DL of the target BS and obtain DL and UL parameters using the DCD/UCD message. Then RNG_REG/RNG_RSP messages are exchanged to complete the initial ranging process. It may be done in a contention-based or non-contention-based manner.

If the RNG_REG contains the serving BSID, the target BS can obtain the MS information from the serving BS through the backbone network. If the MS is already associated with the target BS at the previous stage, some steps may be omitted. Therefore, the neighboring BS scanning and association should be done right after the handover initiation by utilizing preobtained information before the channel condition changes.

If all physical parameter adjustments are done successfully, the network re-entry process is initiated. Figure 3 shows this procedure. It includes MS authorization and new BS registration. The target BS requests MS authorization information via its backbone network. The new BS registration is performed by REG_REQ and REG_RSP messages. This includes capabilities negotiation, MS authorization, key exchange, and registration. After successful registration with the target BS, the MS can send a MOB_HO-IND message to the serving BS to indicate that handover is completed.

Network Entry, Initialization & Ranging Process | WiMAX Mobility Management

1. Network Entry and Initialization

A SS needs to successfully complete the network entry process with a desired BS to join the network. The network entry process is composed of four stages. The first stage is capability negotiation. After successful completion of initial ranging, the SS will request the BS to describe its available modulation capability, coding schemes, and duplexing methods. During this stage, the SS shall acquire a DL channel. Once the SS finds a DL channel and synchronizes with the BS at the PHY level, the MAC layer will look for DCD (downlink channel descriptor) and UCD (uplink channel descriptor) to get modulation and other parameters. The SS remains in synchronization with the BS as long as it continues to receive the DL-medium access protocol (MAP) and DCD messages. Finally, the SS will receive a set of transmission parameters from UCD as its UL channel. If no UL channel can be found after a suitable timeout period, the SS shall continue scanning to find another DL channel. Once the UL parameters are obtained, the SS shall perform the ranging process.

The second stage is authentication. In this stage, the BS authenticates and authorizes the SS. Then the BS performs key exchange with the SS, such that the provided keys can enable the ciphering of transmission data. The third stage is registration. To register with the network, the SS and the BS will exchange registration request/response messages. The last stage is to establish IP connectivity. The SS gets its IP address and other parameters to establish IP connectivity. After this step, operational parameters can be transferred and connections can be set up.

2. Ranging Process

Ranging is the process of acquiring the correct timing offset and power adjustments such that the SS's transmission is aligned to the BS's timing. Two types are supported for ranging process in the IEEE 802.16e-2005 specification. One is initial ranging, and the other is periodic ranging.

Initial ranging is performed during network initialization and registration/reregistration to allocate CDMA codes in UL ranging opportunities. Then the SS is allowed to join the network to acquire correct TX parameters (timing offset and TX power level). On the other hand, periodic ranging is performed when transmission is on-going on a periodic basis. It uses regular UL burst to allow SS to adjust TX parameters so that the SS can maintain UL communications with the BS.