Distributed Authentication in Wireless Mesh Networks Through Kerberos Tickets
Draft History
Problem and motivation
Requirements
Kerberos Extension Solution Proposal 1/2
Potential Use-Cases
Next Step

Kerberos Extension Solution Proposal 2/2
o Shared secrets distribution mean should not compromise the security of the whole network:
– If shared secrets are required by each mesh node at each time interval, this would generate lot of traffic during the communication with the KDC.
– If shared secrets for future time intervals are pre-generated by the KDC and given in batch to each user, this would optimize traffic, but if a node is compromised at an interval of time, all the shared secrets would be known and the network would be compromised.
o The KDC sends to each mesh node the current interval shared secret and the pre-generated ones for the future, while each pre-generated shared secret is encrypted with a key corresponding to its related time interval.
– This encryption key should be sent to each mesh node in the corresponding time interval either through Kerberos protocol or through a multicast routing protocol.
o Group keys can be also considered allowing
– To have a shared secret for each group of mesh nodes (Mesh nodes sharing the same group key are nodes sharing some common characteristics “making a cluster, hierarchal group keys for example, …” ).
– Each mesh node participate to more than one group and hence to have several group keys.
– If one group key is compromised it could be deleted by the KDC.