IEEE TRANSACTIONS ON VEHICULAR TECHNOLOGY, VOL. 60, NO. 1, JANUARY 2011 219 Fast Handoff in Secure IEEE 802.11s Mesh Networks Kuang-Hui Chi, Member, IEEE, Yung-Chien Shih, Ho-Han Liu, Jui-Tang Wang, Shiao-Li (Charles) Tsao, Member, IEEE, and Chien-Chao Tseng Abstract—While mesh networking is gaining momentum with widespread application, we are concerned with fast handoff in a secure mesh environment. To this end, this paper presents a means in the context of IEEE 802.11s of letting a mesh portal act as an IEEE 802.1X authenticator to reduce costly IEEE 802.1X authen- tication processes during handoff. Our approach is developed for alignment with IEEE 802.11s and 802.11i, keeping protocols at the station side operable with no changes. As another strength, our design applies to generic multihop wireless networks. Both analyt- ical and simulation modeling are conducted to evaluate our scheme as well. Performance results show that our approach reduces handoff delay by up to 268% or achieves comparable performance resulting from the counterpart IEEE 802.11i scheme with high likelihood of 70%–85% successful preauthentication. Moreover, our performance analysis suggests an optimal number of access points managed by one mesh portal in a network. Qualitative and quantitative discussions indicate that our approach is applica- ble in pragmatic settings. Index Terms—Fast handoff, IEEE 802.11i, IEEE 802.11s, mesh network, random walk model, security domain. I. I NTRODUCTION I EEE 802.11s specifies how IEEE 802.11 devices are inter- connected for mesh networking [3], [8], [13]. A wireless mesh network does not necessitate cabling, as opposed to a typ- ical architecture where stations communicate via access points (APs) attached to a wired medium. This new type of network architecture facilitates rapid deployment and is evolving as a vital means of public access to the Internet services. A handoff process occurs when a station moves its associ- ation from one AP to another, causing a blackout period of communication disruption. Handoff involves AP discovery, au- Manuscript received September 8, 2008; revised June 11, 2010 and August 6, 2010; accepted October 1, 2010. Date of publication October 28, 2010; date of current version January 20, 2011. This work was supported by the National Science Council under Grant NSC 97-2221-E-009-051-MY3, Grant NSC 99-2220-E-009-046, and Grant 7352B41100. The review of this paper was coordinated by Dr. L. Chen. K.-H. Chi is with the Department of Electrical Engineering, National Yunlin University of Science and Technology, Touliu 640, Taiwan (e-mail: chikh@yuntech.edu.tw). Y.-C. Shih is with the Institute of Computer Science and Engineering, National Chiao Tung University, Hsinchu 300, Taiwan, and also with Telcor- dia Applied Research Center Taiwan Company, Taipei 115, Taiwan (e-mail: ycshih@csie.nctu.edu.tw). H.-H. Liu, S.-L. Tsao, and C.-C. Tseng (Corresponding author) are with the Institute of Computer Science and Engineering, National Chiao Tung University, Hsinchu 300, Taiwan (e-mail: hohanliu@gmail.com; sltsao@csie. nctu.edu.tw; cctseng@csie.nctu.edu.tw). J.-T. Wang was with the Institute of Computer Science and Engineering, National Chiao Tung University, Hsinchu 300, Taiwan. He is now with the In- formation and Communications Research Laboratories, Industrial Technology Research Institute, Hsinchu 310, Taiwan (e-mail: rtwang@csie.nctu.edu.tw). Color versions of one or more of the figures in this paper are available online at http://ieeexplore.ieee.org. Digital Object Identifier 10.1109/TVT.2010.2090050 Fig. 1. Mesh networking security architecture. thentication, reassociation establishment, and inter-AP transfer of physical connectivity or credential information specific to the mobile station. AP discovery by the station identifies APs within range. The authentication procedure refers to legacy open-system and IEEE 802.1X authentication processes [9]. For user authentication and keying material distribution, the IEEE 802.1X framework has been adopted as a mandatory part of Robust Security Networks (IEEE 802.11i [11]). With IEEE 802.1X transactions at a remote site, internetwork operations account for another potentially prohibitive delay. As far as secure communication is concerned, however, we should avail ourselves of IEEE 802.11i mechanisms to the greatest extent possible. This paper deals with roaming in an IEEE 802.11 mesh network while maintaining secure communication, as per IEEE 802.11i. As shown in Fig. 1, a mesh network comprises a mesh security domain and AP security domains. A security domain refers to a set of network entities on which a same security policy is exercised under a single administrative authority [23]. The mesh security domain covers mesh points (MPs) connect- ing to a mesh portal (MPP), whereas an AP security domain encompasses a mesh AP (MAP) and its local stations. (A MAP is an MP providing additional AP functionality.) Observe that current policies adopted in these security domains are different; links among MPs are protected by IEEE 802.11s, whereas connectivity between a station and its local MAP is protected by IEEE 802.11i mechanisms. Whenever a mobile station switches its association to a new MAP, IEEE 802.1X requires the station and an Authentication Server situated its home network to authenticate each other. IEEE 802.1X authentication involves mostly multiple rounds of message exchanges through the Internet, at the expense of nontrivial delay. For this, a number of fast handoff schemes have been developed, e.g., [9], [17]–[20], [22], and [24] (see [21] for an expository survey). However, these schemes did not take mesh infrastructure into account. As a remedy, we 0018-9545/$26.00 © 2010 IEEE