Abstract This paper describes the experience and findings of deploying a vehicular scenario based on a heterogeneous network. WiMAX and Wi‐Fi have been chosen as access technologies because of their wide presence in the market and their different coverage range. Our approach has been developed, taking into account crucial aspects regarding mobility and security. These two aspects have been provided by Network Mobility and Internet Key Exchange version 2 protocols, respectively. In addition, a study about how to interoperate them has been performed, describing the benefits and drawbacks of every existing approach. Regarding handover latency, some improvements have been identified in order to reduce it to the minimum. Fast authentication methods, pre‐authentication method, and “multiple care‐of addresses” mechanism are examples of these improvements. Copyright © 2012 John Wiley & Sons, Ltd.

A common practice is applying security after a network has been designed or developed. We have the opportunity of not committing this error in vehicular networks. Apart from particular works in the literature, ETSI TC ITS has defined general security services for (vehicular) cooperative systems. However, existent efforts do not pay the needed attention to the integration of IPv6 yet. The potential of IPv6 in the field is being described within ISO TC 204, above all, but further work is needed for a proper integration of security. This work follows this direction, and a reference vehicular communication architecture considering ETSI/ISO regulations, uses Internet Protocol security (IPsec) and Internet Key Exchange version 2 (IKEv2) to secure IPv6 Network Mobility (NEMO). A key advance is also the implementation and experimental evaluation of the proposal in a challenging vertical handover scenario between 3G and 802.11p. The performance of the secured NEMO channel is widely analyzed in terms of the movement speed, bandwidth, traffic type or signal quality, and it is concluded that the addition of IPv6 security only implies a slight reduction in the overall performance, with the great advantage of providing confidentiality, integrity and authenticity to the communication path.

In order to ensure end user devices are healthy enough to gain access to the network, providers are making use of advanced network access control solutions, which propose an evaluation of configuration information (posture) about the device itself before providing access to the network. However, current solutions are focused on intra-domain scenarios, where end users and network belong to the same organization. This work proposes an architecture to provide this trusted network access control in other emerging scenarios: network roaming federations, like eduroam, where the accessed network provider is not where the end user belongs to. The paper describes how authentication and authorization mechanisms for these scenarios can be integrated to provide trusted network access control.