Tomás P. de Miguel DIT-UPM. dit UPM



Similar documents
Mobility on IPv6 Networks

Introduction to Mobile IPv6

IP and Mobility. Requirements to a Mobile IP. Terminology in Mobile IP

Mobile IP. Bheemarjuna Reddy Tamma IIT Hyderabad. Source: Slides of Charlie Perkins and Geert Heijenk on Mobile IP

Mobile IP Part I: IPv4

IPv6 Fundamentals: A Straightforward Approach

Dedication Preface 1. The Age of IPv6 1.1 INTRODUCTION 1.2 PROTOCOL STACK 1.3 CONCLUSIONS 2. Protocol Architecture 2.1 INTRODUCTION 2.

Introducing Reliability and Load Balancing in Mobile IPv6 based Networks

Neighbour Discovery in IPv6

Mobile Routing. When a host moves, its point of attachment in the network changes. This is called a handoff.

Wireless Networks: Network Protocols/Mobile IP

6 Mobility Management

Mobility Management in DECT/IPv6 Networks

IPv6 Functionality. Jeff Doyle IPv6 Solutions Manager

Security Assessment of Neighbor Discovery for IPv6

Implementing DHCPv6 on an IPv6 network

IPv6 mobility and ad hoc network mobility overview report

Guide to Network Defense and Countermeasures Third Edition. Chapter 2 TCP/IP

IPv6 Associated Protocols

MPLS VPN in Cellular Mobile IPv6 Architectures(04##017)

About the Technical Reviewers

IPv6 Advantages. Yanick Pouffary.

Static and Dynamic Network Configuration

IPv6 Trace Analysis using Wireshark Nalini Elkins, CEO Inside Products, Inc.

ΕΠΛ 674: Εργαστήριο 5 Firewalls

IPv6 Hardening Guide for Windows Servers

Firewalls und IPv6 worauf Sie achten müssen!

Telecommunication Services Engineering (TSE) Lab. Chapter III 4G Long Term Evolution (LTE) and Evolved Packet Core (EPC)

Getting started with IPv6 on Linux

Internet Protocol: IP packet headers. vendredi 18 octobre 13

Computer Networks. Wireless and Mobile Networks. László Böszörményi Computer Networks Mobile - 1

Mobility Management 嚴 力 行 高 雄 大 學 資 工 系

Introduction to IP v6

IPv6 associated protocols. Piers O Hanlon

Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network.

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003

21.4 Network Address Translation (NAT) NAT concept

Types of IPv4 addresses in Internet

ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science

Protocol Security Where?

Internet Protocol Version 6 (IPv6)

IPv6 SECURITY. May The Government of the Hong Kong Special Administrative Region

Security with IPv6 Explored. U.S. IPv6 Summit Renée e Esposito Booz Allen Hamilton Richard Graveman RFG Security

Internetworking. Problem: There is more than one network (heterogeneity & scale)

G.Vijaya kumar et al, Int. J. Comp. Tech. Appl., Vol 2 (5),

Mobile Internet Protocol v6 MIPv6

IPv6 Fundamentals, Design, and Deployment

SEcure Neighbour Discovery: A Report

REDUCING PACKET OVERHEAD IN MOBILE IPV6

Definition. A Historical Example

Personal Firewall Default Rules and Components

3GPP TS V6.3.0 ( )

Quality of Service in the Internet. QoS Parameters. Keeping the QoS. Traffic Shaping: Leaky Bucket Algorithm

5.0 Network Architecture. 5.1 Internet vs. Intranet 5.2 NAT 5.3 Mobile Network

Internet Connectivity for Ad hoc Mobile Networks

CloudEngine Series Switches. IPv6 Technical White Paper. Issue 01 Date HUAWEI TECHNOLOGIES CO., LTD.

MPLS VPN over mgre. Finding Feature Information. Prerequisites for MPLS VPN over mgre

Datagram-based network layer: forwarding; routing. Additional function of VCbased network layer: call setup.

Chapter 9. IP Secure

Network Mobility Support Scheme on PMIPv6 Networks

ETSI TS V8.9.0 ( )

Technology Brief IPv6 White Paper.

Vulnerabili3es and A7acks

Review: Lecture 1 - Internet History

APNIC elearning: IPSec Basics. Contact: esec03_v1.0

ITL BULLETIN FOR JANUARY 2011

Vicenza.linux.it\LinuxCafe 1

Security Implications of the Internet Protocol version 6 (IPv6)

Telematics. 9th Tutorial - IP Model, IPv6, Routing

Joe Davies. Principal Writer Windows Server Information Experience. Presented at: Seattle Windows Networking User Group June 1, 2011

Troubleshooting Tools

Network Security TCP/IP Refresher

IPv6 Security Best Practices. Eric Vyncke Distinguished System Engineer

IPv6 Fundamentals Ch t ap 1 er I : ntroducti ti t on I o P IPv6 Copyright Cisco Academy Yannis Xydas

Digi Connect WAN Application Helper NAT, GRE, ESP and TCP/UPD Forwarding and IP Filtering

IPv6 Security. Scott Hogg, CCIE No Eric Vyncke. Cisco Press. Cisco Press 800 East 96th Street Indianapolis, IN USA

12. Firewalls Content

IP Address Classes (Some are Obsolete) Computer Networking. Important Concepts. Subnetting Lecture 8 IP Addressing & Packets

Linux Based Implementation and Performance Measurements of Dual Stack Mobile IPv6

Mobile Communications Chapter 8: Network Protocols/Mobile IP

CSCI 454/554 Computer and Network Security. Topic 8.1 IPsec

Chapter 12 Supporting Network Address Translation (NAT)

his document discusses implementation of dynamic mobile network routing (DMNR) in the EN-4000.

IP - The Internet Protocol

TCP for Wireless Networks

VXLAN: Scaling Data Center Capacity. White Paper

Chapter 3 Configuring Basic IPv6 Connectivity

Subnetting,Supernetting, VLSM & CIDR

Mitigation of Breaking Connections. (a.k.a. OLSRd v1 Multi-Gateway & BRDP)

Transcription:

Tomás P. de Miguel DIT-

15 12 Internet Mobile Market Phone.com 15 12 in Millions 9 6 3 9 6 3 0 1996 1997 1998 1999 2000 2001 0 Wireless Internet E-mail subscribers 2 (January 2001)

Mobility The ability to change locations, while connected to the network, accessing information services, anytime, anywhere. Access applications anywhere 4 Low bandwidth 4 Reduced battery life Maintain connections during movement 4 All messages sent to the mobile node are redirected to its real location More than portability 4 Operate at any point of attachment 4 Connections have to be shut down when node is moved 3 (January 2001)

Requirements Without geographical limitations 4 Portable computer work anywhere Network technology independent 4 Detect a local router and connect automatically Must able to communicate with other nodes that do not implement mobility 4 Communicate with any network node 4 Transparent to transport and application levels Without modification in the standard routing procedures or address formats Secure 4 Mobile node identification 4 Exchanged information protected 4 (January 2001)

Connections are identified by a data set There are two attached points in each connection The mobile node 138.4.2.12 The correspondent node 159.206.21.2 Packets can be routed using different ways, but attached points must be always the same. IP connectivity protocol Source A. Dest. A. Source P. Dest. P. CN 5 (January 2001) Internet 159.206.21.2 Home Net. R 138.4.2.12

When location changes, then IP address changes All packets should be routed to the new address IP mobility R 138.100.27.131 Foreign Network However, application should maintain original defined addresses Otherwise, established connections are lost Internet 159.206.21.2 Home net. R 138.4.2.12 CN 6 (January 2001)

To maintain connections, the traffic must be redirected to the new location All the traffic connection between home and foreign network is encapsulated with the help of two agents Home Agent Foreign Agent Such encapsulation is also called tunneling IP mobility service CN 7 (January 2001) Internet 159.206.21.2 R FA 138.100.27.131 Foreign Network Home Net. R 138.4.2.12 HA

Mobility architecture Binding in the Foreign network 4Connection to the Foreign Network 4Home Network registration Information exchange 4From Correspondent Node to Mobile Node Routing using tunneling 4From Mobile Node to Correspondent Node Through Home Network using tunneling (strict routes) Directly to Correspondent Node Remove Registration 4Return to the Home Base 4Move to a new Foreign Network 8 (January 2001)

Service Phase Correspondent nodes establishes connections using Mobile Node s Home Address Traffic from Correspondent Node 4 Correspondent Node Home Agent 4 Home Agent tunnel Foreign Network Foreign Agent Mobile Node Directy to the Mobile Node Traffic from the Mobile Node 4 Strict routing Mobile Node Correspondent Node The source address is the Home Address 4 Direct routing Foreign Network Home Network Mobile Node Foreign Agent tunnel Home Agent Mobile Node tunnel Home Agent Home Agent Foreign Node 9 (January 2001)

Remove registration The Mobile node leaves the Foreign Network Ways to know it 4 Stop the Foreign Agent Advertisement Messages reception during a long time Ask for a explicit advertisement 4 Receive a message from another Foreign Agent Maybe, we are in the same network, but the register should be updated Register a new address in the new network 4 Access a new Foreign Network The Home Agent removes old register and register the new one 4 Return to the Home Network The Home Agent removes the redirection 10 (January 2001)

Mobile IPv6

Facilities with IPv6 Stateless Address Autoconfiguration 4 to configure the Care-of Address 4 there is no need of Foreign Agent Neighbor Discovery 4 to detect movement Route optimization 4 IPv6 Routing Headers IP security 4 implement strong authentication and encryption features Adional facilities 4 Coexistence with Internet Ingress Filtering 4 Smooth Handoffs as part of route optimization 4 Renumbering of home networks 4 Automatic home agent discovery 12 (January 2001)

Mobile Node operation 1. The Mobile Node moves to a new point of attachment 2. Configure a new Care-of Address Use Stateless Address Autoconfiguration Stateful Address Autoconfiguration (DHCPv6) 3. Builds a new binding Update the local Binding Cache List Register the binding in the home subnet Update binding cache in Correspondent Nodes 4. Delivering packets to and from Mobile Node 13 (January 2001)

Movement detection Based on IPv6 Neighbor Discovery 4 Router Discovery Based on-link network prefixes 4 Neighbor Unreachability Detection Suplement with lower protocol layers information Setting the interface into promiscuous receive mode Router discovery 1. Send Router Solicitation Message 2. Wait periodic Router Advertisement messages Mobile Node maintains 4 Default Routers List (with lifetime) 4 Prefix Network List (with lifetime) It is important to quick detect when the router becomes unreacheable 4 Use Neighbor Unreachability Detection 14 (January 2001)

Router advertisement Message It is a modification of Neighbor Discovery message 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Type Code Checksum Cor Hop Limit M O H Rsv Router Lifetime Reachable Time Retrans Timer Options... H : the router is also the Home Agent 15 (January 2001)

Micro mobility In wireless networks mobile node has to report every movement to his home network This cause huge amount of signaling traffic and disturbing latency during handoffs. To solve it, the Home Network does not have to know the exact location of the Mobile Node Home Agent will allow mobile nodes to acquire new addresses while still using previously allocated addresses. Smooth Handoffs 4 Accept packets at previous care-of address even after reporting the new Care-of Address to its Home Agent 16 (January 2001)

Binding Binding 4 Association (Mobile Node s Home Address - Care-of Address) 4 Lifetime of the association The Node Bindings Cache List is the central data structure of Mobile IPv6 A Mobile Node may have more than one Care-of Address at a time Primary Care-of Address 4 Is the address of the most recent Mobile Node s binding Binding could be a source of security problems 4 Binding packets must include IPv6 Authentication Header 17 (January 2001)

Binding update Register the new Care-of Address 4 Request the home subnet router to function as the Home Agent for the Mobile Node. 4 Home Agent register only one mobile binding The Primary Care-of Address Binding is also use with Correspondent Nodes 4 It can be included in any normal packet Binding is also send alone whenever 4 Mobile suspects that its Home Agent is not operational 4 Correspondent is not sending packets to the proper Care-of Address Mobile must not send Binding Updates to often Mobile may choose its location private When Mobile Node returns to its home subnet use Home Address as the Care-of Address 4 It must also send IPv6 Neighbor Advertisement 18 (January 2001)

Correspondent Node binding update Correspondent Node maintains a Binding Cache List to learn the actual mobile address (the Primary Careof Address) Binding Update 4 After configuring a new Care-of Address 4 When binding is out of date Binding Update must be acknowledged 4 using Binding Acknowledgement Destination options can appear in any IPv6 packet 19 (January 2001)

Binding and acknowledgement 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Option Type Option Length A H R D Rsv Prefix Length Sequence Number Lifetime Sub-Options 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 Option Type Option Length Status Sequence Number Lifetime Lifetime Refresh Sub-Options 20 (January 2001)

Destination Options IPv6 header Next Header = Authentication Authentication header Next Header = Destination Options Destination Options header Next header = TCP TCP header TCP data 21 (January 2001)

Route optimization IPv6 allows to send and receive packets directly to or from Correspondent Nodes. Packets are routed using IPv6 Routing Headers IPv6 encapsulation is used only when the Correspondent Node does not know the actual location of the Mobile Node 4Packets are sent to the Home Address 4Home Agent redirect received packets to the Mobile Node The Home Agent can not use Routing Headers Home Agent use IPv6 Neighbor Discovery to intercept mobile packets received in the Home Network. 22 (January 2001)

Home Agent discovery Not always is possible or convenient for a Mobile Node to know the exact address of its Home Agent Mobile can dynamically discover it 4 Sending a Binding Update to the IPv6 anycast address The anycast address is received by exactly one router on the home subnet. Any router must reject the Binding Update 4 Send a Binding Acknowledgement with its unicast address The mobile will then repeat its Binding Update directly to the router that returned the rejection 23 (January 2001)

Handling errors Packets from Correspondent to Mobile Node can generate ICMP error messages. It is important to correctly return to the original sender the generated error. If Correspondent Node use Routing Header, the source address will be that of the Correspondent Node. 4 Then ICMP messages will be returned directly to the Correspondent Node. If Correspondent Node has no Binding Cache entry the packet will be intercepted by the Home Agent, encapsulated and tunneled to the Care-of Address 4 The source address in the tunnel is the Home Agent address 4 But ICMP errors must be received in the Correspondent Node 4 IPv6 use encapsulation with relay ICMP errors to the original sender 4 ICMP contain a portion of a packet generating the error 24 (January 2001)

Renumbering the Home Subnet All nodes on a subnet can gracefully autoconfigure new addresses. 4 Router issuing multicast Router Advertisement packets Mobile nodes outside its Home Network must receive Router Advertisement Packets 4 Home Agent tunnel multicast Router Advertisement packets Protocol rules 4 The mobile assumes that home network prefix has not changed until the reception of a Router Advertisement 4 Router Advertisement must be authenticated 4 Mobile must perform the standard autoconfiguration operation 4 Mobile may send a Router Solicitation message to its home Agent at any time 25 (January 2001)

Security Ipsec protection mechanisms must be included in all 4 Binding updates 4 Binding Acknowledgements It is not required for Binding Requests The great deal is the coexistence between 4 Mobility 4 Internet security features (Firewalls) Ingress Filtering 4 Many border routers discard packets coming from within the interprise if the packets do not contain a source IP address configured for one of the interprise s internal networks 4 The solution of this problem involves tunneling outgoing packets from the care-of address The destination is the Home Agent 4 Encapsulate the packet to the Firewall 26 (January 2001)

Open Issues Link Layer 4Medium access control, channels reservation, security Network Layer 4Mobility management, admission control, resource reservation, point-to-point routing, quality of service Transport Layer 4High data loss, variable delays Applications 4Mobile computing, replication, emulation, synchronization, resource location, multimedia. 27 (January 2001)

Applications Mobility is not only a network issue Many applications have problems if they don t recognize mobility 4different access points 4low reliable links 4variable bandwidth Replication, emulation and synchronization Resource location Multimedia and real time applications 28 (January 2001)