Secure communication is very important in computer networks and authentication is one of the most eminent preconditions. However, common authentication schemes are not applicable in ad hoc networks because public key infrastructures with a centralized certification authority are hard to deploy there. We propose and evaluate a security concept based on a distributed certification facility. A network is divided into clusters with one special head node each. These cluster head nodes execute administrative functions and hold shares of a network key used for certification. New nodes start to participate in the network as guests; they can only become full members with a network-signed certificate after their authenticity has been warranted by some other members. The feasibility of this concept was verified by simulation. Three different models for node mobility were used in order to include realistic scenarios as well as make the results comparable to other work. The simulation results include an evaluation of the log-on times, availability, and communication overhead.

Ubiquitous communication will be one of the paradigms for the next decades. The use of the Internet in such applications demands for a highly reliable and secure system, especially when used in non-academical environments like remote offices, e-commerce, or traffic telematics. Today's Internet, even with the mobility extension Mobile IP, has not been designed with private addresses, firewalls, network address translation quality of service etc. in mind. Several optimisations already exist-however security is often neglected. This paper proposes the firewall-aware transparent Internet mobility architecture FATIMA, which integrates security functionality but is transparent to existing Mobile IP implementations. All security critical functions are concentrated in a firewall, all control messages are authenticated, and micro-mobility is supported. Corporate networks with private addresses are supported seamlessly, and further extensions allow for the use of dynamic home addresses and quality of service support.