Unlinkable authentication for roaming user in heterogeneous wireless networks

The 3rd Generation Partnership Project published the specifications of heterogeneous cellular and wireless local area networks interworking, enabling to provide high-speed data services along with anywhere, anytime connectivity to mobile users. In order to achieve the required security properties in such settings, Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA) is adopted. However, the fact that the EAP-AKA is vulnerable to a type of man-in-the-middle attack as well as potential threats to user privacy causes major obstacles on the practical use of the technologies. In this paper, we describe a new scheme for supporting secure and unlinkable user authentication in the cellular and wireless networks interworking settings. Our scheme achieves all required security properties including security against the man-in-the-middle type of attacks, replay attacks, and rogue access point attacks. It guarantees user privacy with no scalability problem. It does not require any synchronization mechanism. It requires only five communication rounds. Furthermore, it does not impose the requirement of the public-key infrastructure.