Efficient Management of the Traffic Flows in Wireless Internet. Contents. The mobile Internet. Evolution in telecom technologies

Transcription

1 Efficient Management of the Traffic Flows in Wireless Internet An Introduction to Wireless IP International Workshop on Internet Security and Management 28 Jan, Sendai, Japan Abbas Jamalipour 1 Abbas Jamalipour The University of Sydney Australia Contents The mobile Internet Can mobile Internet be defined like this? 1. An Introduction to Wireless IP 2. Wireless Internet Security 3. Quality of Service Global Internet To other telecommunication?? Location-independent access Wire-free access 4. Conclusions IP-based core network INTERNET ACCESS IP-based access network Access Node Mobile Node Seamless access?? ISP-independent access A. Jamalipour 2 A. Jamalipour 4 Evolution in telecom technologies Trend 2: Voice to data Telephony Wired Wireless Cellular Internet Fixed Wireless Mobile AP Internet? Increase in: No of s Accessibility (time/space) No of applications Network Traffic: Voice, Text, Data, Image, Video,, Multimedia Available options: Working independently Replacing Complementing Significant increase in no. of multimedia users compared with voice 3m mobile data users in 1998 to 77m in 2005: 70% increase per year Today s Internet users: potential users of tomorrow s mobile Internet Pbit/day Voice Traffic Volume Data Traffic Volume A. Jamalipour 5 A. Jamalipour 7 Trend 1: Fixed to mobile access Get the first 50m users Saturation of fixed access for voice in near future 400m mobile subscribers worldwide in 2000 and 1800m in 2010 Similar exponential increase pattern in number of Internet subscribers Million Users Fixed Lines Mobile Lines Fixed Internet Years S Public Telephony Radio Television CellularMobile Inte rnet Network Broadcasting Broadcasting C om m unications (years) A. Jamalipour 6 A. Jamalipour 8

2 The application-oriented oriented Internet Telecom of the future Number of Internet users FTP Telnet WWW Variety Growth of Internet Applications embedded Internet and wireless Internet Internet to: connect people connect devices connect people/ devices Supporting new and existing applications Horizontal communication between different access technology cellular, cordless, WLAN, short-range connectivity, wired On a common platform to complement each other s Connected through a common, flexible, seamless IP-based core network An advanced media access technology that connects the core network to different access technologies Global roaming and inter-working between different access technologies both horizontal (intra-system) and vertical (intersystem) handover Seamless negotiation including mobility, security, QoS A. Jamalipour 9 A. Jamalipour 11 Mobile Internet applications Interoperated telecom architecture Office Information virtual working groups Education??? mobile office Public tele-working Financial virtual school Services schedule Services synchronisation on-line public elections laboratories and voting on-line banking on-line library public information universal SIM- Information on-line training help & credit card Leisure internet-surfing remote broadcast s Communication home shopping intelligent search- consultation yellow pages video telephony stock quotes virtual book store & filtering agents video conferencing music on demand on-line media speech games on demand on-line translation video-clips Special Telemetric local information announcing s virtual sight seeing booking & Services Services SMS ski net, Disney net (Machine-Machine reservation electronic postcard lottery s security Services) news s location based??? hotline tracking (GPS) tele-medicine navigation assistance travel information fleet management remote diagnostics??? 3G UMTS/cdma2000 other wireless/wired common core network indoor highspeed public telephony switched packet data A. Jamalipour 10 A. Jamalipour 12 A network architecture of the future mobile Summary Global Internet Wireless LAN GSM cdmaone Private IP Network cdma2000 Core cdma2000 Access Network ADSL Satellite Backbone IP Core Network Internetwork Access Technology DECT GPRS/UMTS Core PSTN/ISDN UMTS Access Network Applications were and will be the driving wheels in evolution of all telecommunication. Success of the Internet is mainly due to its accessibility and the usage of an open architecture. Mobility is a recognized feature of the future telecommunication. Multimedia mobile applications will force the future to be united under a common platform and incorporate efficiently to complement s of each other. But, wouldn t this integration add new complications to QoS and network security? A. Jamalipour 13 A. Jamalipour 15 Two Dimensional Internetworking Requirements Global Networks 3G Mobile Networks 2G Mobile Networks Hot Spot Networks Personal Networks Wired Networks GEO SAT MEO/LEO SAT DAB/DVB UMTS cdma2000 UWC-136 GSM GPRS cdmaone PDC Wireless LAN PHS Ad Hoc DECT Bluetooth PSTN ADSL Internet Efficient homogeneous traffic flow management as well as QoS management techniques are required. Capable of delivering QoS and security on an end-to-end basis within the heterogeneous (wired/wireless) Traffic flow volume is needed to be controlled by discriminatory preferences given to individual users and application data. A. Jamalipour 14 A. Jamalipour 16

3 Internet security Wireless Internet Security Network Security Privacy Authentication Integrity Non-repudiation 2 Abbas Jamalipour aka secrecy: Only sender and intended receiver should understand the message S: Encryption R: Decryption Receiver is confident of the sender s identity The content of the received message is exactly same as what was sent by original sender Receiver must be able to prove that the sender did send the message (sender cannot deny it) A. Jamalipour 19 Why security? Internet attacks Sniffing Original reasons in necessity of Internet security Internet is a broadcasting medium PLUS A third party can intercept a message which is not encrypted Read, write, or delete the data being transferred Increase in number of internetworking A C Growth in number and variety of network hosts Increase in variety of network applications Increase in amount of data stored in network and their storage locations src:b dest:a payload B Increase in volume of data being exchanged A. Jamalipour 18 A. Jamalipour 20 Internet attacks IP spoofing Where to secure? Internet is a broadcasting medium Application layer A third party can pretend to be the original sender by putting the original sender s IP address in the source IP field For private, authenticated transactions using certificate infrastructure; e.g. SET (secure electronic transaction), digital signatures, Pretty Good Privacy (PGP) and Secure Shell A C Transport layer Data encryption using certificate infrastructure; e.g. SSL, TLS Network layer src:b dest:a payload Data protection across the network; e.g. IPSec, Firewall, AAA B Link layer Physical layer Encoding the data before sending on air for physical isolation A. Jamalipour 21 A. Jamalipour 23 Internet attacks Denial of Basic security techniques Internet is a broadcasting medium Encryption and decryption A third party can overloading the receiver by flooding malicious packets A C Also Distributed DoS: by multiple coordinated sources B Mainly to create privacy but are also applied in the other three parts of the network security Secret key (aka symmetric key) Using the same key shared between sender and receiver pair and common encryption/decryption algorithms Use of short keys: ideal for encrypt/decrypt long messages One key for each pair: too many keys are needed for all Public key Use of a private key and a public key Private key is kept by receiver, public key is announced to public Less keys required, but more complex algorithms: good for short messages A. Jamalipour 22 A. Jamalipour 24

4 Digital signature Service agreement (SA) Handles authentication, integrity and non-repudiation Signing the message using encryption techniques Sender encrypt the message using his private key Receiver decrypt the message using sender s public key Integrity: If the message is changed by an intruder, there is a high probability that the message is unreadable. Authentication: Using a different private key will result a different message than the one sent by the sender. Non-repudiation: The private key of the sender can be tested on the original plaintext thus the sender cannot deny sending the message. A source-destination handshake for AH and ESP protocols Creating network-layer logical channel called a agreement (SA) Each SA is unidirectional and uniquely determined by: The security protocol (AH or ESP) The source IP address A 32-bit connection ID A. Jamalipour 25 A. Jamalipour 27 IPSec: : Network layer security Encapsulating security payload Providing a framework and a mechanism only Encryption/authentication selections are left to the user Can provide network layer secrecy and authentication Network layer secrecy: sending host encrypts TCP and UDP segments, ICMP and SNMP messages in IP datagram Network layer authentication: destination host can authenticate the source IP address Defining two protocols at the network layer Authentication header (AH) protocol To provide integrity and authentication (digital signature) Encapsulating Security Payload (ESP) protocol To provide privacy plus integrity and message authentication Provides secrecy, host authentication, data integrity Data and ESP trailer are encrypted Next header field is in ESP trailer ESP authentication field is similar to AH authentication field Protocol = 50 Authenticated Encrypted IP Header ESP Header TCP/UDP Segment ESP Trailer ESP Auth Protocol = 50 A. Jamalipour 26 A. Jamalipour 28 Authentication header protocol Provides source host authentication, data integrity, but not secrecy AH header inserted between IP header and data field Protocol field = 51 Intermediate s process datagrams as usual AH header includes: IP Header AH Header TCP/UDP Segment connection ID authentication data: signed message digest, calculated over original IP datagram, providing source, authentication, data integrity Next header field: specifies type of data (TCP, UDP, ICMP, etc.) 3 Quality of Service Abbas Jamalipour A. Jamalipour 29 Security in wireless Internet General QoS requirements All issues and techniques explained so far are also applicable to the wireless Internet security, but Are they still sufficient? Are they still efficient? Are they all supportable in heterogeneous? Are those techniques scalable enough? Are the security threats limited to those considered? Security should be considered as an end-to-end issue So, in order to resolve the above doubts and to implement security (which would be redefined at a later time), security has to be treated similar to other quality of themes Technology-based quality of requirements Timeliness delay response time delay variation Bandwidth system level data rate application level data rate transaction rate Reliability mean time to failure mean time to repair meantime between failures loss or corruption rate A. Jamalipour 30 A. Jamalipour 32

5 QoS requirements, more Challenging wireless QoS management User-level quality of requirements critically perceived QoS based on data transmission application type picture detail picture color accuracy video rate video smoothness audio quality video/audio synchronization cost per-use cost per-unit cost security confidentiality (information access only by appropriate users) integrity (information not to be corrupted) digital signatures authentication (verification of a user s identity and right to access) Data applications over wireless channel require sophisticated techniques of quality of management short loss of communications during handover is not desirable, though it is acceptable in voice applications similar facilities required in the new point of attachment after any handover blind spots are unavoidable in wireless End-user QoS is also affected by certain specifications of portable terminals battery limit screen size processing power screen resolution More importantly, traffic flows are transported by a variety of, each with its QoS and security treatment techniques A. Jamalipour 33 A. Jamalipour 35 BW vs. coverage in wireless Improving QoS in IP Wider coverage and higher mobility equal to higher cost but not necessarily higher data rate Wireless network Coverage Data rate Infrared Room 19.2 kbps-4 Mbps IEEE /b/a m around each AP 1, 2/11/54 Mbps GSM (HSCSD) Cellular network 9.6 (56) kbps CDPD (for AMPS, IS-95, IS-136) Cellular network 19.2 kbps DECT, PHS Cellular network 32 kbps GPRS (for GSM) Cellular network 155 kbps UMTS/IMT-2000 Cellular network 384 kbps to 2 Mbps Iridium LEO Satellite Global 2.4 kbps Broadband satellites Global/regional 2 Mbps Harmonic QoS adjustment on an end-to-end basis is also challenging when more than one network involved Looking for an ideal and general network QoS model IETF groups are working on proposals to provide better QoS control in IP, i.e., going beyond best effort to provide some assurance for QoS Work in Progress includes RSVP, Differentiated Services, and Integrated Services Simple model for sharing and congestion studies: A. Jamalipour 34 A. Jamalipour 36 Principles for QoS guarantees QoS guarantees, more Consider a phone application at 1Mbps and an FTP application sharing a 1.5 Mbps link bursts of FTP can congest the and cause audio packets to be dropped want to give priority to audio over FTP Alternative to marking and policing: allocate a set portion of bandwidth to each application flow can lead to inefficient use of bandwidth if one of the flows does not use its allocation PRINCIPLE 1: marking of packets is needed for to distinguish between different classes; and new policy to treat packets accordingly PRINCIPLE 3: while providing isolation, it is desirable to use resources as efficiently as possible A. Jamalipour 37 A. Jamalipour 39 QoS guarantees, more QoS guarantees, more Applications misbehave (audio sends packets at a rate higher than 1Mbps assumed above) PRINCIPLE 2: provide protection (isolation) for one class from other classes Require policing mechanisms to ensure sources adhere to bandwidth requirements; marking and policing need to be done at the edges Cannot support traffic beyond link capacity PRINCIPLE 4: need a Call Admission Process application flow declares its needs network may block call if it cannot satisfy the needs A. Jamalipour 38 A. Jamalipour 40

6 QoS summary IntServ: : Advantages and disadvantages Now, let s have some examples from Internet and cellular Advantages provides classes which closely match different apps leaves the existing best-effort unchanged no change to the existing apps, efficient as current Internet leaves forwarding mechanism in the network unchanged non-upgraded can receive data from IntServ Disadvantages E2E guarantee requires IntServ support by all nodes subdivision of best-effort may cause problems in commercial A. Jamalipour 41 A. Jamalipour 43 IP solutions for QoS support Differentiated s (DiffServ( DiffServ) Integrated s (IntServ) Three classes of guaranteed- class provides for delay-bounded agreements controlled-load class provides for a form of statistical delay agreement (nominal mean delay) best-effort s interactive burst (e.g. Web), interactive bulk (e.g. FTP), and asynchronous (e.g. ) Guaranteed and controlled-load s are based on quantitative requirements and require signaling and admission control in network nodes usually Resource Reservation Protocol (RSVP) is used Aims at providing simple, scalable and flexible differentiation using a hierarchical model interdomain resource management unidirectional levels are agreed at each boundary point between a customer and a provider for traffic entering the provider network intradomain resource management provider is solely responsible for configuration and provisioning of resources within its domain Provider builds its offered s with a combination of traffic classes, traffic conditioning, and billing DiffServ does not impose either the number of traffic classes or their characteristics on a provider Based on local agreements at customer/provider boundaries Per-flow state is avoided within the network since individual flows are aggregated in classes A. Jamalipour 42 A. Jamalipour 44 DiffServ,, more DiffServ: : Advantages and disadvantages Aggregates the entire customer s requirements for QoS The customer must have a level agreement (SLA) with provider SLA specifies the forwarding the customer receives static or dynamic static SLA: negotiated on a long-term basis (e.g., monthly) dynamic SLA: changes more frequently For receiving different levels, the customer must mark its packets by specific values in TOS filed (renamed DS field) DSCP (differentiated s codepoint) unused DS field supersedes the existing definition of IPv4 TOS octet and the IPv6 traffic class octet Advantages provides discrimination based on payment for traffic classes are accessible without signaling as a traffic class is predefined aggregate of traffic classification of the traffic needs not be performed in the end system (simpler network management) Disadvantages DiffServ tries to keep the operating mode of the network simple by pushing as much complexity as possible onto network provisioning and configuration DiffServ does not make providing several s with different qualities within the same network easier A. Jamalipour 45 A. Jamalipour 47 DiffServ 3-level s IntServ and DiffServ A A comparison access s Local Differentiated Services Domain interior access s interior access s border contracted link border Transit Internet Network interior IntServ Requires flow-specific state for each flow at s increase of state information based on number of flows need huge storage space and processing power at make s much more complex DiffServ Simpler and more scalable Scalability: per-flow replaced with per-aggregate complex processing is moved from the core of network to the edge A. Jamalipour 46 A. Jamalipour 48

7 GPRS example of QoS support UMTS architectural improvements SMS-GMSC SMS-IWMSC QoS profile assigned to every subscriber E traffic precedence class MSC/VLR high, normal, and low priority Gs D A delay class Gb four classes R Um reliability class SGSN Gn GGSN five classes peak throughput class 8, 16, 32, 64, 128, 256, 512, 1024, 2048 kbps mean throughput class 19 classes from best-effort to 111 kbps Profile requested by user or as default defined in the home location register (HLR) SGSN responsible for fulfilling the QoS profile Gd Gn TE MT BSS SGSN GGSN Gp Other PLMN C Gr SMS-SC HLR Gc Gf Gi EIR PDN TE Signaling Signaling & Data Compared with GSM Wideband access higher bit rates toward mobile multimedia applications Mobile-fixed-Internet convergence a uniform way to offer cross-domain s to users portability across and terminals Flexible architecture enhancing creativity and flexibility for new s standardizing the blocks that make up s and not s themselves A. Jamalipour 49 A. Jamalipour 51 UMTS network architecture UMTS and open architecture GSM Circuit Switched MSC (Real-Time) CS BSC ATM MSCu BTS IP Core Non-Real-Time Data Services SGSN GGSN UMTS RNC ATM IP Node B PSTN Feature Servers Providing access of UMTS architecture via OSA to third party providers To enhance portability of telecommunications s between and terminals (Rel-5, TS ) Virtual Home Environment (VHE) A system concept for personalized portability across boundaries and between terminals Considered by 3GPP (Rel-5, TS ) Use of s available at home network even after roaming into another network e.g., VHE converts a WAP into SMS when WAP is not available in the visiting network A. Jamalipour 50 A. Jamalipour 52 VHE for UMTS VHE SCS specifications application SCS 1 call control network layer SCS 2 home location register application SCS 5 CAMEL application layer standardized -network UMTS interfaces SCS 3 mobile execution environment SCS 4 SIM application toolkit Call control (CC) : MSC to support circuit-switched telephony using CC protocol (R99) Home location register (HLR): database for location and subscriber information using MAP protocol Mobile execution environment (MExE) server: for value-added s through WAP SIM application toolkit (SAT) server: to offer additional capabilities to communications protocol between SIM and mobile terminal Customized application for mobile enhanced logic (CAMEL) server: extends the scope of IN provisioning to the mobile environment and to exchange mobile-specific information between CAMEL and switching point (SSP) and control point (SCP) A. Jamalipour 53 A. Jamalipour 55 VHE elements UMTS QoS support Enabling development of s independent of the underlying A layered UMTS architecture Service capability (SCS): that provide functionality used to construct s (e.g. MSC) Service capability features (): the classes of OSA interface SCSs are network elements whereas s are only additional software layer of interface classes on top of SCSs Examples of s: call control, location/positioning, notifications Traffic class Fundamental characteristics BER Example of the application Conversational class Preserve time relation between information entities of the stream Conversational pattern (stringent and low delay) 10-3 Voice, videotelephony, video games Streaming class Preserve time relation between information entities of the stream 10-5 Streaming multimedia Interactive class Request response pattern Preserve data integrity 10-8 Web browsing, network games Background class Destination is not expecting the data within a certain time Preserve data integrity 10-8 Background download of s A. Jamalipour 54 A. Jamalipour 56

8 E2E quality of in 3G/UMTS Access layer MT TE MS RAN CN TE local bearer terminal-to-terminal QoS 3G/UMTS bearer external bearer Mobile station supports in regard to provider radio access technology signaling standards supporting only a single packet data (Simple IP or Mobile IP); differentiation at higher layers Access network authenticates and authorizes MS for access establishes a connection to IMT-2000 network initializes a data link layer After this link layer establishment, network layer protocols are executed to establish the packet data session 3G/UMTS QoS A. Jamalipour 57 A. Jamalipour 59 cdma2000 Data link layer cdmaone cdma2000 cdma2000 network architecture BTS AN BSC PCF PCF AN- AAA MSC/ VLR PDSN PCN AAA HLR HA PSTN Data Link Layer Internet Higher Layers Network Layer Access Layer Security Packet data reference model to other packet data Service Access Provider Support of two types of data link layers by IMT network PPP for Version 1 and 2 PPP protocol in compliance with RFC 1661 PPP compression control protocol (RFC 1962) used to negotiate a PPP payload compression algorithm In Mobile IP, higher layers will not be reset when the mobile re-establishes PPP to a new IMT-2000 serving area Simple data link-layer protocol for Version 2 A. Jamalipour 58 A. Jamalipour 60 Network layer Two types of network access methods Mobile IP Local and public network access HA resides in IMT-2000 provider network (SPN) Authentication and authorization by SPN or a private network Private network access HA resides in a private network Authentication and authorization by the private network Simple IP Local and public network access IP address is dynamically assigned from the serving network Private network access Same with addition of VPN software in mobile station 4 Abbas Conclusions Jamalipour A. Jamalipour 61 Security Layered manageable architecture Three levels of security from mobile station perspective Radio access security Authentication of the mobile station Support of air interface encryption IP network security For Mobile IP, use of FA challenge to authenticate mobile station For Simple IP, use of CHAP or PAP to authenticate mobile station CHAP: Challenge Handshake Authentication Protocol PAP: Password Authentication Protocol Both at the data link layer User end-to-end security Additional security measures provided by the user (optional) A generic architecture that covers all under same assumptions and I/O traffic flows Application level: harmonization of all different data into a unified form, prioritization of data according to the application and requested Physical level: optimization of data transmission based on the unified data Network level: management of the traffic flow transportation by resolving shortfall of the access network in providing requested to the application; should be open, configurable, and scalable Tasks include: traffic management, mobility management, QoS management, security management, and resource management Packet-based Traffic Application Level Non-packetbased Traffic Encapsulated Data Network Management Level Traffic Security QoS Mobility Physical Level Wireless Cellular ADSL Wireless LAN Wired Networks A. Jamalipour 62 A. Jamalipour 64

9 MWIF layered functional network architecture Application Third party applications API Security Applications/ Services Service Directory Services Authorization API Global Name Servers Policy Servers Location Servers Mobility Management Resource Management API OAM&P Control Communication Session Management Access Specific Core Access Gateway Transport Access Network Network Gateways Terminals Other Networks PSTN/external CS External IP Legacy 2G Signaling A. Jamalipour 65 References A. Jamalipour, The Wireless Mobile Internet Architectures, Protocols and Services, John Wiley & Sons, Chichester, England,. J. Kurose and K. Ross, Computer Networking A Top-Down Approach Featuring the Internet, Second Edition, Addison Wesley, Boston, D. Wisely, P. Eardley, and L. Burness, IP For 3G, John Wiley & Sons, Chichester, England, A. Jamalipour 66