Mobile IP and DHCP. Motivation for Mobile IP. Terminology

Transcription

1 Motivation for Mobile IP Motivation transfer Encapsulation Security Mobile IP and DHCP Problems DHCP Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 1 Routing based on IP destination address, prefix (e.g ) determines physical subnet change of physical subnet implies change of IP address to have a topological correct address (standard IP) or needs special entries in the routing tables Specific routes to end-systems? change of all routing table entries to forward packets to the right destination does not scale with the number of mobile hosts and frequent changes in the location, security problems Changing the IP-address? adjust the host IP address depending on the current location almost impossible to find a mobile system, DNS updates take to long time TCP connections break, security problems Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 2 Requirements to Mobile IP (RFC 3344, was: 3220, was: 2002) Transparency mobile end-systems keep their IP address continuation of communication after interruption of link possible point of connection to the fixed can be changed Compatibility support of the same layer 2 protocols as IP no changes to current end-systems and s required mobile end-systems can communicate with fixed systems Security authentication of all messages Efficiency and scalability only little additional messages to the mobile system required (connection typically via a low bandwidth radio link) world-wide support of a large number of mobile systems in the whole Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 3 Terminology Mobile Node () system (node) that can change the point of connection to the without changing its IP address Home Agent () system in the home of the, typically a registers the location of the, tunnels IP datagrams to the COA Foreign Agent () system in the current of the, typically a forwards the tunneled datagrams to the, typically also the default for the Care-of Address (COA) address of the current tunnel end-point for the (at or ) agent COA, co-located COA actual location of the from an IP point of view can be chosen, e.g., via DHCP, for a co-located COA Correspondent Node () communication partner Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 4

2 Example transfer to the mobile system 2 home (physical home for the ) end-system mobile end-system (current physical for the ) home sender 1 3 receiver 1. Sender sends to the IP address of, intercepts packet (proxy ARP) 2. tunnels packet to COA, here, by encapsulation 3. forwards the packet to the Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 5 Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 6 transfer from the mobile system Overview 1 home COA home sender home Sender sends to the IP address of the receiver as usual, works as default 1. receiver Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 7 Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 8

3 Network integration Agent Advertisement and periodically send advertisement messages into their physical subnets listens to these messages and detects, if it is in the home or a (standard case for home ) reads a COA from the advertisement messages Registration (always limited lifetime!) signals COA to the via the, acknowledges via to sends a request (through UDP) containing the COA to : sets up a mobility binding containing the mobile node s home IP address and the current COA these actions have to be secured by authentication Advertisement advertises the IP address of the (as for fixed systems), i.e. standard routing information s adjust their entries, these are stable for a longer time ( responsible for a over a longer period of time) packets to the are sent to the, independent of changes in COA/ Agent advertisement type = 16 = * #COAs type = 16 R: required B: busy, no more s H: home agent F: agent M: minimal encapsulation G: GRE encapsulation r: =0, ignored (former Van Jacobson compression) T: supports reverse tunneling reserved: =0, ignored type code checksum #addresses addr. size lifetime address 1 preference level 1 address 2 preference level 2 lifetime... sequence number R B H F M G r T reserved COA 1 COA 2... Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 9 Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 10 Registration Mobile IP request t request request reply reply Foreign agent COA t request reply Co-located COA type = 1 S B DMG r T x lifetime home address home agent COA identification extensions... (containing parameters for authentication) S: simultaneous bindings (specify if the wants he to retain prior mobility bindings) B: broadcast datagrams ( wants to receive the broadcast packets received by the ) D: decapsulation by M mininal encapsulation G: GRE encapsulation r: =0, ignored T: reverse tunneling requested x: =0, ignored Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 11 Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 12

4 Mobile IP reply type = 3 code lifetime home address home agent identification Example codes: extensions... successful 0 accepted 1 accepted, but simultaneous mobility bindings unsupported denied by 65 administratively prohibited 66 insufficient resources 67 mobile node failed authentication 68 home agent failed authentication 69 requested Lifetime too long denied by 129 administratively prohibited 131 mobile node failed authentication 133 Identification mismatch 135 too many simultaneous mobility bindings Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 13 Encapsulation original IP header original data new IP header new data outer header inner header original data Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 14 Encapsulation I Encapsulation of one packet into another as payload e.g. IPv6 in IPv4 (6Bone), Multicast in Unicast (Mbone) here: e.g. IP-in-IP-encapsulation, minimal encapsulation or GRE (Generic Record Encapsulation) IP-in-IP-encapsulation (mandatory, RFC 2003) tunnel between and COA TTL IP-in-IP IP checksum IP address of Care-of address COA TTL lay. 4 prot. IP checksum IP address of IP address of TCP/UDP/... payload Encapsulation II Minimal encapsulation (optional) avoids repetition of identical fields e.g. TTL, IHL, version, DS (RFC 2474, old: TOS) only applicable for unfragmented packets, no space left for fragment identification TTL min. encap. IP checksum IP address of care-of address COA lay. 4 protoc. S reserved IP checksum IP address of original sender IP address (if S=1) TCP/UDP/... payload Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 15 Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 16

5 Generic Routing Encapsulation C: checksum field present R: offset and routing fields present K: key field (for authentication) present S: sequence number field present s: strict source routing used rec.: recursion control field (number of allowed recursive encapsulations) RFC 1701 TTL GRE IP checksum IP address of Care-of address COA CR K S s rec. rsv. ver. protocol checksum (optional) offset (optional) key (optional) sequence number (optional) routing (optional) TTL lay. 4 prot. IP checksum IP address of IP address of TCP/UDP/... payload C outer header new header GRE header RFC 2784 reserved0 ver. checksum (optional) original header original header new data original data original data protocol reserved1 (=0) Optimization of packet forwarding Triangular Routing sender sends all packets via to higher latency and load Solutions sender learns the current location of direct tunneling to this location informs a sender about the location of : cache the location information in the binding cache big security problems! Change of packets on-the-fly during the change can be lost new informs old to avoid packet loss, old now forwards remaining packets to new this information also enables the old to release resources for Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 17 Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 18 Change of agent Reverse tunneling (RFC 3024, was: 2344) old new Update ACK 2 Warning Update ACK Registration changes location home 1 sender Request Update ACK t receiver 3 1. sends to 2. tunnels packets to by encapsulation 3. forwards the packet to the receiver (standard case) Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 19 Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 20

6 Mobile IP with reverse tunneling Mobile IP and IPv6 Router accept often only topological correct addresses (firewall!) a packet from the encapsulated by the is now topological correct furthermore multicast and TTL problems solved (TTL in the home correct, but is to far away from the receiver) Reverse tunneling does not solve problems with firewalls, the reverse tunnel can be abused to circumvent security mechanisms (tunnel hijacking) optimization of data paths, i.e. packets will be forwarded through the tunnel via the to a sender (double triangular routing) The standard is backwards compatible the extensions can be implemented easily and cooperate with current implementations without these extensions Agent Advertisements can carry requests for reverse tunneling Mobile IP was developed for IPv4, but IPv6 simplifies the protocols security is integrated and not an add-on, authentication of is included COA can be assigned via auto-configuration (DHCPv6 is one candidate), every node has address autoconfiguration no need for a separate, all s perform advertisement which can be used instead of the special agent advertisement; addresses are always co-located can signal a sender directly the COA, sending via not needed in this case (automatic path optimization) soft hand-over, i.e. without packet loss, between two subnets is supported sends the new COA to its old the old encapsulates all incoming packets for the and forwards them to the new COA authentication is always granted Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 21 Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 22 Problems with mobile IP Security in Mobile IP Security authentication with problematic, for the typically belongs to another organization no protocol for key management and key distribution has been standardized in the patent and export restrictions Firewalls typically mobile IP cannot be used together with firewalls, special set-ups are needed (such as reverse tunneling) QoS many new reservations in case of RSVP tunneling makes it hard to give a flow of packets a special treatment needed for the QoS Security, firewalls, QoS etc. are topics of current research and discussions! Security requirements (Security Architecture for the Protocol, RFC 1825) Integrity any changes to data between sender and receiver can be detected by the receiver Authentication sender address is really the address of the sender and all data received is really data sent by this sender Confidentiality only sender and receiver can read the data Non-Repudiation sender cannot deny sending of data Traffic Analysis creation of traffic and user profiles should not be possible Replay Protection receivers can detect replay of messages Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 23 Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 24

7 IP security architecture I IP security architecture II Two or more partners have to negotiate security mechanisms to setup a security association typically, all partners choose the same parameters and mechanisms Two headers have been defined for securing IP packets: Authentication-Header guarantees integrity and authenticity of IP packets if asymmetric encryption schemes are used, non-repudiation can also be guaranteed IP-Header header Authentification-Header authentication header UDP/TCP-Paket data Mobile Security Association for s parameters for the mobile host (MH), home agent (), and agent () Extensions of the IP security architecture extended authentication of MH- authentication - authentication MH- authentication request request MH reply reply Encapsulation Security Payload protects confidentiality between communication partners not encrypted IP header ESP header encrypted encrypted data prevention of replays of s time stamps: 32 bit time stamps + 32 bit random number nonces: 32 bit random number (MH) + 32 bit random number () Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 25 Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 26 Key distribution Home agent distributes session keys agent has a security association with the home agent mobile host registers a new binding at the home agent home agent answers with a new session key for agent and mobile node MH response: E - {session key} E -MH {session key} DHCP: Dynamic Host Configuration Protocol Application simplification of installation and maintenance of ed computers supplies systems with all necessary information, such as IP address, DNS server address, domain name, subnet mask, default etc. enables automatic integration of systems into an Intranet or the, can be used to acquire a COA for Mobile IP Client/Server-Model the client sends via a MAC broadcast a request to the DHCP server (might be via a DHCP relay) DHCPDISCOVER DHCPDISCOVER client relay server client Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 27 Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 28

8 time DHCP - protocol mechanisms DHCP characteristics server (not selected) determine the configuration DHCPDISCOVER DHCPOFFER DHCPREQUEST (reject) client initialization collection of replies DHCPDISCOVER DHCPOFFER selection of configuration DHCPREQUEST (options) server (selected) determine the configuration confirmation of configuration Server several servers can be configured for DHCP, coordination not yet standardized (i.e., manual configuration) Renewal of configurations IP addresses have to be requested periodically, simplified protocol Options available for s, subnet mask, NTP ( time protocol) timeserver, SLP (service location protocol) directory, DNS (domain name system) initialization completed DHCPACK Big security problems! no authentication of DHCP information specified release DHCPRELEASE delete context Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 29 Dr. Ka-Cheong Leung CSIS 7304 The Wireless and Mobile Computing 30