Early Binding Updates for Mobile IPv6 Early Binding Updates for - PowerPoint PPT Presentation

Early Binding Updates for Mobile IPv6 Early Binding Updates for Mobile IPv6 Christian Vogt, chvogt@tm.uka.de Roland Bless, bless@tm.uka.de Mark Doll, doll@tm.uka.de Tobias Küfner, kuefner@tm.uka.de IEEE Wireless and Communications and Networking Conference New Orleans, March 15, 2005 Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 1

Mobile IPv6 Scenario Mobile IPv6 Scenario FTP Home Agent Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 2

Outline Outline � Mobile IPv6 basics � Security and efficiency � Proposed optimization � Early Binding Updates � Credit-Based Authorization � Analysis � Conclusion Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 3

Mobile IPv6 Basics Mobile IPv6 Basics Mobile Node Mobile Node Care- -of Address of Address Care 3000::/64 3000::/64 Internet Home Address Home Address 2000::/64 2000::/64 Correspondent Correspondent Node Node Home Address = global ID above IP Home Address = global ID above IP Care- Care -of Address = locator of Address = locator Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 4

Mobile IPv6 Basics Mobile IPv6 Basics Mobile Node Mobile Node Care- -of Address of Address Care Home Agent Home Agent 3000::/64 3000::/64 Internet Home Address Home Address 2000::/64 2000::/64 Correspondent Correspondent Node Node Home Address = global ID above IP Home Address = global ID above IP Care- Care -of Address = locator of Address = locator Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 5

Be Aware! Be Aware! Issue 1: Impersonation � Attacker binds a false HoA to some CoA Victim's Man i/t middle Victim peer (false HoA) (true HoA) � Unauthorized use of a HoA ⇒ connection hi-jacking, eavesdropping, man-in-the-middle attacks, DoS Amplification Issue 2: Packet Misdirection � Attacker redirects packets to a false CoA � Unauthorized use of a CoA ⇒ flooding Attacker's Victim Attacker peer (false CoA) (true CoA) Solution: HoA/CoA-ownership proofs (HoA/CoA tests) Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 6

What Mobile IPv6 Does About It… … What Mobile IPv6 Does About It Relationship btw. MN and HA � Long-lasting � Pre-configuration: Credentials, authorization records � Mobile IPv6: IPsec authentication Relationship btw. MN and CN � Usually without history � No pre-configuration � Key exchange insufficient; HoA/CoA-ownership proof required � Mobile IPv6: non-cryptographic HoA/CoA tests Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 7

What Mobile IPv6 Does About It… … What Mobile IPv6 Does About It Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Detach Detach Attach Attach Registration with HA Home Registration with CN Registration with CN Address Test Care-of Address Test Binding 〈 〈 RFC 3775 RFC 3775 〉 〉 Update to CN Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 8

…And How This Performs And How This Performs … Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Last packet Last packet Detach Detach Attach Attach Registration 1 RTT with HA Home Address Test First packet First packet Care-of Address Test Binding 〈 RFC 3775 〈 RFC 3775 〉 〉 Update to CN Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 9

…And How This Performs And How This Performs … Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Last packet Last packet Detach Detach Attach Attach Registration 2 RTT with HA Home Address Test Care-of Address Test First packet First packet Binding 〈 RFC 3775 〈 RFC 3775 〉 〉 Update to CN Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 10

Our Objectives Our Objectives Need Optimization Which… � significantly reduces handover latency across domains and without special network support Related Work � Local: Hierarchical Mobile IPv6, Fast Handovers � pro: low latency, zero packet loss � con: network support required, no inter-domain optimization � End-to-end: Cryptographically Generated Addresses � pro: cryptographic HoA-ownership proof, eliminates HoA test � con: CoA test still required Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 11

Our Approach: Early Binding Updates Our Approach: Early Binding Updates Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Home Do this test be- Address Test fore handover! Detach Detach Registration Attach Attach with HA Register early Early Binding with the CN! Update to CN Use CoA Care-of Address Test during test! Binding 〈 Early Binding Updates 〈 Early Binding Updates 〉 〉 Update to CN Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 12

Unverified Care- -of Addresses of Addresses Unverified Care Issue: CoA unverified for a while � Period of vulnerability btw. Early and standard Binding Update � Negligible in some scenarios, usually requires additional protection Solution: Prevent amplification � Observation: amplification (not misdirection per se) makes redirection-based flooding attractive � Rationale: no amplification ⇒ redirection-based flooding unattractive � Credit-based technique Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 13

Our Solution: Credit- -Based Authorization Based Authorization Our Solution: Credit Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Acquires credit by sending pkts. Maintains Consumes credit credit account for being sent pkts. to unverified CoA Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 14

Our Solution: Credit- -Based Authorization Based Authorization Our Solution: Credit Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 15

Our Solution: Credit- -Based Authorization Based Authorization Our Solution: Credit Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 16

Our Solution: Credit- -Based Authorization Based Authorization Our Solution: Credit Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 17

Our Solution: Credit- -Based Authorization Based Authorization Our Solution: Credit Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 18

Our Solution: Credit- -Based Authorization Based Authorization Our Solution: Credit Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 19

Our Solution: Credit- -Based Authorization Based Authorization Our Solution: Credit Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 20

Our Solution: Credit- -Based Authorization Based Authorization Our Solution: Credit Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Detach Detach Attach Attach CoA unverified Signaling not Signaling not shown shown Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 21

Our Solution: Credit- -Based Authorization Based Authorization Our Solution: Credit Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Detach Detach Attach Attach CoA unverified Signaling not Signaling not shown shown Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 22

Our Solution: Credit- -Based Authorization Based Authorization Our Solution: Credit Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Detach Detach Attach Attach CoA unverified Signaling not Signaling not shown shown Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 23

Our Solution: Credit- -Based Authorization Based Authorization Our Solution: Credit Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Detach Detach Attach Attach CoA unverified Signaling not Signaling not shown shown Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 24

Our Solution: Credit- -Based Authorization Based Authorization Our Solution: Credit Home Agent Home Agent Correspondent Correspondent Mobile Node Mobile Node Node Node Detach Detach Attach Attach CoA unverified Signaling not Signaling not shown shown Christian Vogt, Research Institute of Telematics, University of Karlsruhe, Germany 25