1 / 29

Securing Mobile and Wireless Networks

Securing Mobile and Wireless Networks. Will Ivancic wivancic@grc.nasa.gov 216-433-3494. Outline. Network Security, What is it? Security Truths Mobile and Wireless Networks Issues / Challenges USCG/NASA/Cisco Neah Bay Project Military Scenarios Conclusions.

catlett
Télécharger la présentation

Securing Mobile and Wireless Networks

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Securing Mobile and Wireless Networks Will Ivancic wivancic@grc.nasa.gov 216-433-3494

  2. Outline • Network Security, What is it? • Security Truths • Mobile and Wireless Networks • Issues / Challenges • USCG/NASA/Cisco Neah Bay Project • Military Scenarios • Conclusions

  3. Network Security – What is it? • !!! Policy !!! • Encryption • AAA (Authentication, Authorization and Accounting) • Architecture • Confidentiality • Prevention, Detection and Correction

  4. Security Truths • Security is necessary • Security is painful - At least to date it is • Security breaks everything - Well, enough things so that it appears to break everything - Lots of ingenuity required to make things work New IETF End-to-End concept/reality is application-to-application rather than to machine-to-machine  due to middleware.

  5. Security Truths ENCRYPTION ON THE RF LINK ENCRYPTION AT THE NETWORK LAYER VIRTUAL PRIVATE NETWORK HEADER HEADER HEADER HEADER PAYLOAD ORIGINAL PACKET • Security  Bandwidth Utilization  • Security  Performance  • Tunnels Tunnels Tunnels and more Tunnels • Performance  Security   User turns OFF Security to make system usable! • Thus, we need more bandwidth to ensure security.

  6. Mobile and Wireless Networks What Do We Mean?

  7. Entire Networks in Motion - Mobile Router (One View)

  8. Mobile Network (Another View) • Mobile users rather than mobile networks • VPNs • Dial-In • Wireless LANs • DHCP  This is what the corporate user of the airborne Internet “sees” as mobility  This is the cabin environment

  9. Issues and Challenges

  10. ACME SHIPPING Shared Infrastructure MR MR ACME Shipping Canadian Coast Guard FA FA HA Public Internet MR HA US Coast Guard If I run encryption on the wireless links, it will be very difficult to share infrastructure – Policy and Architecture HA MR HA US Navy

  11. Asymmetrical Pathing Internet Home Agent Foreign Agent Foreign Agent MilStar, Globalstar, Others DVB Satellite Bi-directional links are often assumed. Unidirectional links can be problematic for encryption and AAA. Mobile Router

  12. Reparenting the HA in Mobile-IP X Secondary Home Agent Primary Home Agent Reparenting Home Agent Helps resolve triangular routing Problem over long distances Encryption associations break when handing off between networks 

  13. Key Distribution • Painful • Difficult • Needs to be worked to be more manageable and scalable • Problem grows as network grows • Sharing infrastructure makes the problem more difficult • Military key distribution is even worse Fortunately, this problems is being addressed by industry

  14. Middleware • Firewalls • Network Address Translators (NATs) • Performance Enhancing Proxies • Load Sharing Devices • Traffic Shapers • Web Accelerators • Transparent Proxies • Normalizers

  15. Middleware • Middleware is a reality and it doesn’t appear to be going away. Rather its use is increasing – particularly with regard to network security • This patchwork of "goop" we’re putting in the network may be degrading the performance of the network. • It is defiantly degrading our ability to figure out what is wrong with the network. • We need to consider how the architecture should be changed to meet some of the challenges the network faces today that were not issues when the original vision was developed. • Deep thinking on architectural principles for the new millennium.

  16. Example #1 • GRC personnel ran what appeared to be a complete successful transaction from inside the GRC firewall to a machine at BBN that was outside the GRC firewall. • Problem was that the BBN machine had been turned off for six months! • GRC proxy spoofed the transaction. • So you thought you sold you ENRON shares before it tanked, but you were wrong – only, you didn’t know it until it was to late. • Or, you thought you sent a successful command to the aircraft, but you were wrong  • The Network Researchers say something is wrong, it is broken. • The Security Implementers say that is the way it is suppose to work.

  17. Example #2 Internet • Mobile-IP using IPv4 • GRC firewall blocks UDP traffic • Need to open UDP port 436 • Security Issue (Policy) • Triangular routing squashed at GRC proxy/NAT • Responses to transactions that originated outside the firewall are blocked by the proxy/NAT which is holding state. • Proxy never saw transaction initiated from within GRC network, so response to the transaction is blocked. • Reverse tunneling solves problem, at a cost of increased overhead and time delay Mobile Unit Foreign Agent Router Proxy Home Network Corresponding Node

  18. Middleware and Encryption • Encryption renders most (if not all) Performance Enhancing Proxies (PEPs) useless relative to the encrypted flow. • Many types of encryption make QoS engineering problematic • Protocol header bits hidden (IP in IP) • TOS header bits may be hidden

  19. Neah Bay / Mobile Router Project Detroit Foreign-Agent Neah Bay Outside of wireless LAN range, connected to FA via Inmarsat. Neah Bay Connected to FA via wireless LAN at Cleveland harbor Foreign-Agent Somewhere, USA Cleveland Foreign-Agent Internet Home-Agent Anywhere, USA

  20. Security Issues Being Addressed • Shared Infrastructure • Wireless LAN Security • Advancements to WEP • Mixed Address Space • NATs and Proxies • Low Rate Links • Satellite Links • Performance over multiple tunnels • Manageable and Scaleable Architecture

  21. RF Encryption SW WB WB WB WB WB WB Type 1 Encryption Layer-3 Network Encryption Satellite ISP DSL ISP Wireless Encryption Interim Solution – HA Directly connected to Internet via DSL ? GlobalStar or INMARSAT Satellite FA Internet Satellite Antenna System DSL / with Subnet VOIP Taclane HA HA (Loopback has Public Address) MR USCG Intranet VOIP Taclane FA - CLEVELAND Tachyon FA – Pelee Island? FA - DETROIT IPSec tunneled link from open Internet to HA Public Address

  22. INTRANET 10.x.x.x INTERNET PIX-506 Mobile LAN 10.x.x.x MR Public PROXY/NAT FA – Cleveland Public FA - Detroit HA Public 802.11b link PIX- 506 – until we install our PIX FW Then we should not need the baby PIX.

  23. Protect the MR LAN • Firewall between MR LAN and MR as well as HA and Private Intranet • Tunnels necessary between FAs on Internet and Firewall to provide connection of private address space over public Internet. • Reverse tunneling required as requests from MR LAN hosts must pass through Proxy inside main firewall.

  24. HA Outside/Collocated with Main Firewall • Firewall between MR interfaces and public Internet as well as FA interfaces connecting to the private Intranet and the HA and Private Intranet. • Multiple VPNs required. One for each possible interface combination. • Tunnels necessary between FAs on Internet and Firewall to provide connection of private address space over public Internet. • Reverse tunneling required as requests from MR LAN hosts must pass through Proxy inside main firewall. VPNs take care of this.

  25. Military Applications Battle Group Command Center (BGCC) Mobile-Router deployed in Field Artillery Units. Home-Agent deployed in BGCC Foreign-Agent deployed in Mobile Command Post. Tactical data forwarded from surveillance satellites to the BGCC. Artillery Support Group Intelligence Control Center UAV AWACS UAV Foreign-Agent deployed in UAV Communications link between BGCC and the Field Command Posts Foreign-Agent deployed in UAV Foreign-Agent deployed in Tracked Command Post Carrier. Foreign-Agent deployed in Mobile Command Post. Mobile-Router deployed in Airborne Support Units. Mobile-Router deployed in Armored Field Units. Mobile-Router deployed in Field Units. Battle Group A Battle Group B Battle Group C

  26. ATN Security Notes • Encryption • Still under development • Asymmetric Cryptography (Public/Private Keys) • Session Specify Secret Key (variant of Diffie-Hellman) • Message Authentication • HMAC, IETF RFC 2104 • Hash Function(Secure Hash Algorithm Revision One NIST) • Authentication • Digital Signature (elliptic curve variant of Digital Signature Algorithm) • Hash Function • Asymmetric Enciphered (private key) • Certificate Authority • Cross-certificates

  27. Example of Cryptographic Services Can CPDLC bandwidth handle encryption and AAA?

  28. Example of Certificate Environment

  29. Conclusions • Security is necessary, albeit often painful • Key distribution and AAA methods need to be developed that ease the deployment • We need to be aware of middleware • Increased security requires increased bandwidth and connectivity • A mobile networks means different things to different people • Mobile user • Entire networks in motion • To much security may result in less security • Security bypassed for the sake of performance!

More Related