Page 253 - M. Abrahim Thesis

Computer Network 2026

Figure 54: Mutual authentication and encryption-key derivation

in our earlier study of 802.11 networks—the mobile device and the AP. We also see a new
architectural component, the authentication server (AS) that will be responsible for
authenticating the mobile device. The authentication server might be co-located in the AP, but
more typically, it is implemented as a separate server that provides authentication services.

For authentication, the AP serves as a pass-through device, relaying authentication and key
derivation messages between the mobile device and the authentication server. Such an
authentication server would typically provide authentication services for all APs within its
network.

We can identify four distinct phases to the process of mutual authentication and encryption-key
derivation and use in:
1. Discovery.
In the discovery phase, the AP advertises its presence and the forms of authentication
and encryption that can be provided to the mobile device. The mobile device then
requests the specific forms of authentication and encryption that it desires. Although the
device and AP are already exchanging messages, the device has not yet been
authenticated nor does it have an encryption key for frame transmission over the wireless
link, and so several more steps will be required before the device can communicate
securely through the AP.
2. Mutual authentication and shared symmetric key derivation.
This is the most critical step in “securing” the 802.11 channel. As we will see, this step is
greatly facilitated by assuming (which is true in practice in both 802.11 and 4G/5G
networks) that the authentication server and the mobile device already have a shared
common secret before starting mutual authentication. In this step, the device and the
authentication server will use this shared secret along with nonces (to prevent relay
attacks) and cryptographic hashing (to ensure message integrity) in authenticating each

291