The Internet Engineering Task Force (IETF) has worked on\ud
network layer mobility for more than 10 years and a number\ud
of RFCs are available by now. Although the IETF mobility\ud
protocols are not present in the Internet infrastructure as of\ud
today, deployment seems to be imminent since a number\ud
of organizations, including 3GPP, 3GPP2 and Wimax, have\ud
realized the need to incorporate these protocols into their architectures.\ud
Deployment scenarios reach from mobility support\ud
within the network of a single provider to mobility support\ud
between different providers and technologies. Current Wimax\ud
specifications, for example, already support Mobile IPv4,\ud
Proxy Mobile IPv4 and Mobile IPv6. Future specifications will\ud
also support Proxy Mobile IPv6. Upcoming specifications in\ud
the 3GPP Evolved Packet Core (EPC) will include the use of\ud
Mobile IPv4, Dual Stack MIPv6 and Proxy Mobile IPv6 for\ud
interworking between 3GPP and non 3GPP networks.\ud
This paper provides an overview on the state-of-the-art\ud
in IETF mobility protocols as they are being considered by\ud
standardization organizations outside the IETF and focusing\ud
on security aspects

Karagiannis, Georgios

Meyer, Ulrike

Tschofenig, Hannes

English

The Internet Engineering Task Force (IETF) has worked on network layer mobility for more than 10 years and a number of RFCs are available by now. Although the IETF mobility protocols are not present in the Internet infrastructure as of today, deployment seems to be imminent since a number of organizations, including 3GPP, 3GPP2 and Wimax, have realized the need to incorporate these protocols into their architectures. Deployment scenarios reach from mobility support within the network of a single provider to mobility support between different providers and technologies. Current Wimax specifications, for example, already support Mobile IPv4, Proxy Mobile IPv4 and Mobile IPv6. Future specifications will also support Proxy Mobile IPv6. Upcoming specifications in the 3GPP Evolved Packet Core (EPC) will include the use of Mobile IPv4, Dual Stack MIPv6 and Proxy Mobile IPv6 for interworking between 3GPP and non 3GPP networks. This paper provides an overview on the state-of-the-art in IETF mobility protocols as they are being considered by standardization organizations outside the IETF and focusing on security aspects

University of Twente Research Information

On the Security of the Mobile IP Protocol FamilyUlrike Meyer and Hannes TschofenigNokia Siemens NetworksGermanyEmail: ulrike.meyer@nsn.com, hannes.tschofenig@nsn.comGeorgios KaragiannisUniversity of Twente/CTIT/The NetherlandsEmail: g.karagiannis@utwente.nlI. A BSTRACTThe Internet Engineering Task Force (IETF) has worked onnetwork layer mobility for more than 10 years and a numberof RFCs are available by now. Although the IETF mobilityprotocols are not present in the Internet infrastructure asoftoday, deployment seems to be imminent since a numberof organizations, including 3GPP, 3GPP2 and Wimax, haverealized the need to incorporate these protocols into theirar-chitectures. Deployment scenarios reach from mobility supportwithin the network of a single provider to mobility supportbetween different providers and technologies. Current Wimaxspecifications, for example, already support Mobile IPv4,Proxy Mobile IPv4 and Mobile IPv6. Future specifications willalso support Proxy Mobile IPv6. Upcoming specifications inthe 3GPP Evolved Packet Core (EPC) will include the use ofMobile IPv4, Dual Stack MIPv6 and Proxy Mobile IPv6 forinterworking between 3GPP and non 3GPP networks.This paper provides an overview on the state-of-the-artin IETF mobility protocols as they are being considered bystandardization organizations outside the IETF and focusingon security aspects.II. T HE NEED FORSECURITYMobile IP [3], [20] offers a reachability service for mobilenodes (MNs) in which an MN is always identified by the sameIP address, namely its home address, regardless of its currentpoint of attachment to the Internet. While away from home amobile node associates an other IP address, its care-of addresswith its home address with the help of mobility signalling.The care-of address provides the information about the mobilenode’s current location. Packets addressed to a mobile node’shome address are tunneled to its care-of address. The mobilitysignaling for this type of communication happens between thmobile node (MN) and the home agent (HA). The details of themobility signaling procedures are different for IPv4 and IPv6but the underlying principles are the same. The descriptionin this document focuses mainly on IPv6 since it reflects themore recent development in mobility signaling.Mobile IPv6 supports establishing a bi-directional tunnelbetween the MN and the HA such that the traffic between aMN and a CN is routed through the HA in both directions.Alternatively, Mobile IPv6 offers triangular routing and routeoptimization [3], [21]. In the former case, packets from aMN are directly addressed to the corresponding node (CN)whereas packets in the reverse direction travel through theHA. In the latter case, packets are directly exchanged betweenthe MN and the CN without involving the HA. In orderto get this procedure to work there is the need to performmobility signaling between MN, HA and CN. Although routeoptimization is preferred from a performance point of viewnetwork operators prefer to have a tight control over the datatraffic and plan to disable this functionality.In addition to the basic mobility signaling protocols [3],[20], performance enhancements were developed. An exampleis Hierarchical Mobile IP (HMIP [22]), which allows signalingand data traffic to be routed locally in the visited network towhich the MN is attached as long as MN moves within the vis-ited network. As a consequence, local mobility anchor pointshad to be introduced into the architecture. Fig. 1 shows allthe involved entities. Another example is Fast Handovers foMobile IP (FMIP [23]), which accelerates the reestablishmentof IP connectivity for a moving MN e.g. by establishing atunnel between the old and new CoA at the access routers inorder to overcome the latency of binding updates. So far, theselocalized mobility schemes have largely a theoretical character.Fig. 1. Entities in the Mobile Internet ArchitectureA more interesting trend that evolved in the past fewyears is shifting the burden of mobility management from theMN to the network and thus performing mobility handlingindependent of the MN itself. This concept is reflected inProxy Mobile IP (PMIP [18], [19]). PMIP signaling startst a node close to the MN (such as the access router) andterminates at a HA. The access router emulates the homen twork to MN such that the mobility on the IP layer is hiddenfrom the MN.With all these mobility signaling protocols that can run be-tween the MN, HA, CN, local mobility anchors and at accessrouters the classical communication security problems arie:authentication and key establishment between the signalingnodes, integrity protection, replay protection and in somecasesconfidentiality protection of the signaling traffic.To provide integrity and replay protection of mobility sig-naling in MIPv6 between the MN and the HA two approacheswere developed; IPsec protection [3] and an approach similarto Mobile IPv4 called MIPv6 Authentication Protocol [6]. ForIPsec protection IKEv2 [5] in concert with EAP and DiameterEAP [8] was selected for authentication and key exchange be-tween MN and HA. If the MIPv6 Auth. Protocol is used, thenthe keys required for integrity and replay protection betweenMN and HA are derived from keys established between MNand home AAA prior to MIPv6 usage. In Wimax and 3GPPboth security approaches are currently under consideration.Both approaches to secure MIPv6 require the interactionwith the AAA infrastructure. This interaction of mobility sig-naling with the back-end infrastructure also allows to simpl fyconfiguration tasks, such as the configuration of Home Agentsand Home Addresses, and offers key distribution capability(afeature that is needed for the MIPv6 Authentication Protocol).This work is referred to as Mobile IPv6 bootstrapping [7], [10],and investigates two scenarios: the integrated scenario [24] andthe split scenario [4]. In the integrated scenario the networkaccess authentication procedure run between the MN, theAAA client (e.g., access router), local AAA and the homeAAA server is used to convey parameters and to establishthe keying material for subsequent mobility signaling. Thisback-end interaction is described in [13], [24]. Conveyingtheconfiguration parameters, such as Home Agent address, tothe MN happens with the help of DHCP [14]. Subsequently,when the interaction between the MN and the HA takes placethe HA still has to interact with the AAA server [4]. In thesplit scenario there is no such dependency on the networkaccess authentication and the entire bootstrapping procedureis executed between the MN and the HA on the front-endside and between the HA and the AAA server on the back-endside [4]. The back-end infrastructure solutions are available forRADIUS as well as for Diameter and the integrated scenariovariant using RADIUS is used in Wimax.Integrity and replay protection of PMIP signaling betweenan access router and the HA is based on IPsec. The corre-sponding security associations are established with the help ofIKEv2. An authentication option similar to the one specifiedfor MIPv4 or in the MIPv6 Authentication Protocol [6] iscurrently not specified for PMIP. The respective interactionwith the back-end infrastructure for PMIP is outlined in [17].III. C ONCLUSIONThe specification of the basic mobility signaling protocolsincluding the PMIP protocols can be considered matured.Nevertheless, there are still related open issues to be solvd.An example for such an issue is that currently firewallsare typically not aware of MIP-related traffic and thereforeinterfers with MIP signaling. The problem and some solutionsare described in [12], [25], [27]. Another related open issueis location privacy [16], [26]: revealing the care-of addressto the CN can reveal location information to the CN andeavesdropping on binding updates can allow an outsider totrack the movement of the MN. The work in these problemareas is still ongoing.REFERENCES[1] J. Bournelle et al.,Diameter Mobile IPv6: Support for Home Agent toDiameter Server Interaction, Internet draft, work in progress, July 2007.[2] J. Korhonen et al.,Diameter Mobile IPv6: Support for Network AccessServer to Diameter Server Interaction, Internet draft, work in progress,July 2007.[3] D. Johnson et al.,Mobility Support in IPv6, RFC 3775, June 2004.[4] G. Giaretta et al.,Mobile IPv6 bootstrapping in split scenario, Internetdraft, work in progress, May 2007.[5] V. Devarapalli et al.,Mobile IPv6 Operation with IKEv2 and the RevisedIPsec Architecture, RFC 4877, April 2007.[6] A. Patel et al. Authentication Protocol for Mobile IPv6, RFC 4285,January 2006.[7] A. Patel et al.,Problem Statement for bootstrapping Mobile IPv6 (MIPv6),RFC 4640, September 2006.[8] P. Eronen et al.,Diameter Extensible Authentication Protocol (EAP)Application, RFC 4072, August 2005.[9] C. Kaufman,Internet Key Exchange (IKEv2) Protocol, RFC 4306, De-cember 2005.[10] G. Giaretta et al.,AAA Goals for Mobile IPv6, Internet draft, work inprogress, September 2006.[11] K. Chowdhury et al.MIP6-bootstrapping for the Integrated Scenario,Internet daft, work in progress, June 2007.[12] F. Le et al.Mobile IPv6 and Firewalls: Problem Statement, RFC 4487,May 2006.[13] K. Chowdhury, et al.RADIUS Mobile IPv6 Support, Internet draft, workin progress, March 2007.[14] H. Jang, et al.DHCP Option for Home Agent Discovery in MIPv6,Internet draft, work in progress, May 2007.[15] H. Soliman, et al.,Mobile IPv6 support for dual stack Hosts and Routers(DSMIPv6), July, 2007.[16] R. Koodli, IP Address Location Privacy and Mobile IPv6: ProblemStatement, RFC 4882, May 2007.[17] J. Korhonen, et al.,Diameter Proxy Mobile IPv6: Support For MobilityAccess Gateway and Local Mobility Anchor to Diameter Server Interac-tion, Internet draft, work in progress, June, 2007.[18] S. Gundavelli, et al.,Proxy Mobile IPv6, Internet draft, work in progress,September, 2007.[19] K. Leung, et al.,WiMAX Forum/3GPP2 Proxy Mobile IPv4, Internetdraft, work in progress, July, 2007.[20] C. Perkins,IP Mobility Support for IPv4, revised, Internet draft, workin progress, July, 2007.[21] P. Nikander, et al.,Mobile IP Version 6 Route Optimization SecurityDesign Background, RFC 4225, December 2005.[22] H. Soliman, et al.,Hierarchical Mobile IPv6 Mobility Management(HMIPv6), RFC 4140, August, 2005.[23] R. Koodli, Fast Handovers for Mobile IPv6, Internet draft, work inprogress, July 2007.[24] K. Chowdhury, et al.,MIP6-bootstrapping for the Integrated Scenario,Internet draft, work in progress, June 2007.[25] S. Krishnan, et al.,Firewall Recommendations for MIPv6, Internet draft,work in progress, June 2007.[26] Y. Qiu, et al.,Mobile IPv6 Location Privacy Solutions, Internet draft,work in progress, May 2007.[27] H. Tschofenig, et al.,Mobile IP Interactive Connectivity Establishment(M-ICE), Internet draft, work in progress, July 2007.

On the security of the Mobile IP protocol family

AAA Goals for Mobile IPv6, Internet draft, work in progress,

DHCP Option for Home Agent Discovery in MIPv6, Internet draft, work in progress,

Diameter Mobile IPv6: Support for Home Agent to Diameter Server Interaction, Internet draft, work in progress,

Diameter Mobile IPv6: Support for Network Access Server to Diameter Server Interaction, Internet draft, work in progress,

Diameter Proxy Mobile IPv6: Support For Mobility Access Gateway and Local Mobility Anchor to Diameter Server Interaction, Internet draft, work in progress,

Fast Handovers for Mobile IPv6, Internet draft, work in progress,

Firewall Recommendations for MIPv6, Internet draft, work in progress,

Internet Key Exchange (IKEv2) Protocol,

IP Mobility Support for IPv4, revised, Internet draft, work in progress,

MIP6-bootstrapping for the Integrated Scenario, Internet daft, work in progress,

MIP6-bootstrapping for the Integrated Scenario, Internet draft, work in progress,

Mobile IP Interactive Connectivity Establishment (M-ICE), Internet draft, work in progress,

On the security of the Mobile IP protocol family

Abstract

Similar works

Full text

Available Versions

University of Twente Research Information