Authentication in Protected Core Networking

Protected Core Networking (PCN) is a concept that aims to increase information sharing between nations in coalition military operations. PCN specifies the interconnection of national transport networks, called Protected Core Segments (PCSs), to a federated transport network called Protected Core (PCore). PCore is intended to deliver high availability differentiated transport services to its user networks, called Colored Clouds (CCs). To achieve this goal, entity authentication of all connecting entities is specified as a protective measure. In resource constrained environments, the distribution of service policy can be challenging. That is, which transport services are associated with a given entity. The thesis proposes two new and original protocols where CCs push service policy to the network by performing authentication based on attributes. Using identity-based signatures, attributes constituting a service policy are used directly for an entity's identity, and no external mechanism linking identity and policy is needed. For interoperability, the idea has been incorporated into PKINIT Kerberos and symmetric key Kerberos by carrying the authorized attributes within tickets. The proposed protocols are formally verified in the symbolic model using scyther-proof. The experiment shows that both CCs, and PCSs achieve greater assurance on agreed attributes, and hence on expected service delivery. A CC and a visiting PCS are able to negotiate, and agree on the expected service depending on the situation. The proposed solution provides benefits to CCs on expected service when connecting to a visiting PCS, with poor connectivity to the home PCS. In that respect, interconnection of entities with little pre-established relationship is simplified, and hence fulfillment of the PCN concept is facilitated