1 / 50

Mobility Support in IPv6

Mobility Support in IPv6. Advanced Internet, 2004 Fall 8 November 2004 Sangheon Pack. Content. IP Mobility Mobile IPv6 Basic Operation Mobile IPv6 Security Optimization of Mobile IPv6 Hierarchical Mobile IPv6 (HMIPv6) Fast Handover of Mobile IPv6 (FMIPv6) Conclusion. IP Mobility (1/2).

mercer
Télécharger la présentation

Mobility Support in IPv6

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Mobility Support in IPv6 Advanced Internet, 2004 Fall 8 November 2004 Sangheon Pack

  2. Content • IP Mobility • Mobile IPv6 • Basic Operation • Mobile IPv6 Security • Optimization of Mobile IPv6 • Hierarchical Mobile IPv6 (HMIPv6) • Fast Handover of Mobile IPv6 (FMIPv6) • Conclusion

  3. IP Mobility (1/2) • Routing • Nodes communicate using IP: All IP Network • IP packets are routed by their address • When a mobile node moves, it needs to change IP address to match its current network • Identification • Connections/sessions between nodes are mostly identified by endpoint IP’s • When the node moves, and is assigned a new IP, all existing connections/sessions must be terminated and reestablished! • Need of IP Mobility Protocol!

  4. IP Mobility (2/2) Correspondent Node <IP-A> <-> <IP-B> <IP-A> <IP-B> Mobile Node <IP-C> <IP-B> <-> <IP-C> Mobile Node

  5. Mobile IPv6 (1/3) • Overview • Home network, HA, CoA as the same as Mobile IPv4 • Address auto-configuration • MN can obtain a CoA in foreign network without any help of foreign agent (FA) • Packet interception at the HA • By Neighbor Discovery (cf. Proxy ARP in Mobile IPv4) • Binding update option • Between MN and HA/MN and CN • Route optimization between MN and CN • New extension headers • Type-2 Routing header: for route optimization • Destination Options header: for MN originated packets

  6. Mobile IPv6 (2/3) • Bi-directional tunneling mode • Does not require for the CN to support Mobile IPv6 • Use of Reverse tunneling • Route Optimization (RO) mode • Requires to register the MN’s current binding at the CN • Uses a new type of IPv6 routing header • Destination Address = current CoA • Type-2 routing header = home address • Shortest communications path • Eliminates congestion at the MN’s HA and home link • Impact of any possible failure of the HA or networks on the path to or from it is reduced

  7. Mobile IPv6 (3/3) • Dynamic Home Agent Address Discovery • Allows a MN to dynamically discover the IP address of a home agent on its home link • ICMP Home Agent Address Discovery Request Message • Destination address: Home Agent anycast address for its own home subnet prefix • Reply message • HA address list in home link • HA maintains the home agent lists

  8. Mobile IPv6 Terminology • Terminology • Home Address (HoA) • the permanent IP for identifying the Mobile Node. The Mobile Node should always be reachable at this IP. • Care-of Address (CoA) • the temporary, network-spesific IP for routing messages to the Mobile Nodes current location • Home Agent (HA) • the entity acting on behalf of the Mobile Node in it’s home network • Correspondent Node (CN) • any other host connected to Mobile Node (not necessarily mobile itself)

  9. Mobile IPv4 vs. Mobile IPv6

  10. Binding Update • Binding Update • An MN informs the HA and CNs of its CoA when the MN is located in a foreign network • The HA/CNsend “Binding Acknowledgement” optionto the MN • Requirements • Source address in IP header = MN’s CoA • To avoid ingress filtering • IPv6 authentication header (AH) • For secure binding update

  11. Packet Delivery • Packet delivery from CNto MN • The CN check whether there is the MN’s binding information at its binding cache. • If there is a matched entry • The CN sends packets to the cached MN’s CoA using IPv6 routing header option • No IPv6 encapsulation • Otherwise • Normal packet routing to the MN’s home address • The HA intercepts and tunnels packets. • The MN receiving packets from tunneled by the HA sends a binding update message to the CN

  12. Requirements • Correspondent Nodes • Processing of binding update message • Update its binding cache whenever it receives a new binding update message with a new CoA • Mobile Nodes • When a new CoA is needed • Sending of binding update message • Maintain a Binding Update List • Packet encapsulation/decapsulation: No FA • Home Agents • Packet encapsulation/decapsulation • Proxy neighbor advertisements

  13. Binding Messages • Binding Update • Used by a mobile node to notify other nodes of a new care-adress. • Can also be used to delete old bindings. • Binding Acknowledgement • Used to acknowledge receipt of a Binding Update • Binding Refresh Request • Used by the correspondent node to inform the mobile node that the binding is (or is going) stale • Binding Error • Used by the corresponedent node to signal an error.

  14. Correspondent Node <Home Address> <correspondent address> <-> <home address> Mobile Node <Correspondent Address> IP tunnel Routing option Home Agent Bidirectionaltunnelling Routeoptimization <Care-Of Address> Mobile Node Mobile IPv6 Basic Operation

  15. Binding Update <home address> <care-of address> Binding Update <home address> <new care-of address> BACK Binding Update ACK (BACK) Binding Updates to HA Home Agent map:<home address>:<new care-of address> • MN needs to update the HA on it’s current location (CoA): Binding Update message • The HA keeps this binding for future use Home Agent map:<home address>:<care-of address> Home Agent Mobile Node Mobile Node

  16. IPv6 src=<correspondent address>dst=<home address> BACK BU<home address> <care-of address> IPv6 src=<correspondent address> dst=<care-of address> Routing Option (type 2) Home Address = <home address> IPv6 tunnel:src=<home agent>dst=<care-of address> <original packet encapsulated> IPv6 src=<care-of address> dst=<correspondent address> Destination Option: Home Address = <home address> Binding Updates to CN Correspondent Node map:<home address>:<care-of address> Correspondent Node Home Agent map:<home address>:<care-of address> Home Agent Mobile Node

  17. Mobile IPv6 Security

  18. BU to HA: Security Issues (1/2) • Man-in-the-middle attack Binding Home Agent Mobile Node False BU BACK Malicious Node By means of false BU’s, the traffic can be redirected through a malicious node

  19. BU to HA: Security Issues (2/2) • Hijacking • By means of false BU’s • By replaying old BU’s • Confidentiality breach • By eavesdropping: the MN is often connected to a WLAN • Denial-of-Service (DoS) • By means of false BU’s • An attacker might claim that the MN is at another location. • By replaying old BU’s • Packets for the MN would be sent to its old location. • False BU’s can be used for DoS attacks against victim nodes! • All packets destined to the MN’s home adress would be redirected to the victim node

  20. Mobile IPv6 Security • Protection of BU both to HA and CN • By the use of IPSec extension headers • Home address in BU message: Security association based on the MN’s home address • Security key distribution • Manual or automatic key management with IKE • By the use of the Binding Authorization Data Option • Protection of BU message to CN • No security association • No authentication infrastructure between MN and CN • Return Routability • Binding management key and kbm: assure the right MN is sending message • keyed-hash algorithm using kbm

  21. IPsec SA • IPsec Security Assocation (SA) • An SA is a cryptographically protected connection • There MUST be a SA between the MN and HA • Provides integrity and autentication of BU and BACK • An SA is defined by: <SPI, destination adress, flag> • One SA per home-address • ESP: Encapsulating Security Payload • AH: Authentication Header

  22. ESP and AH • Encapsulating Security Payload (ESP) • Integrity & autenticity • Correct packet ordering • By means of sequence numbers in BU messages • Anti-replay protection • Only if dynamic keying is used • Confidentiality • ”Replay” and ”reordering packets” • Attacks possible if static keys are used • Authentication Header (AH) is an alternative to ESP

  23. Packet Format (1/2) Home Agent Binding Update Binding ACK Mobile Node IPv6 header source = care-of adress destination = home agent Dest. op. header ESP header Mobility header Home adress option home adress Binding update Alt. care-of adress option • The ”mobility header” is used in Mobile IPv6 when managing binding • The ”source adress” avoids ingress filtering • The ”home adress option” is used to identify the SA • The ”alt. care-of adress option” is used to protect the care-of adress

  24. Packet Format (2/2) Home Agent Binding Update Binding ACK Mobile Node IPv6 header source = home agent destination = care-of adress Routing Header (2) ESP header Mobility header Home adress Binding ACK • The ”home adress” in the ”type 2 routing header” helps the mobile node to identify the SA. • Note that the ”Binding ACK” is encrypted

  25. BU to Home Agents: Summary • IPsec SA: Mobile Node <-> Home Agent • Integrity & authentication • Protection against replay and reordering attacks (dynamic keying) • Confidentiality (optional) • Problems • Static SA between Mobile Node and Home Agent • If the 16 bit Mobile IPv6 seq.number is cycled through or the HA reboots and looses state, replay and reordering attacks are possible. • IPsec doesn’t fully prevent an MN to do a DoS attack • However, he will be identified by means of his SA with the Home Agent.

  26. Security Issues: BU to CN • Binding Updating the Correspondent Node • Same issues as with updating the Home Agent • Spoofing • Man-in-the-middle • Confidentiality • Replay • In addition • Need to verify successful routing before switching to route optimization mode • Problem • Not feasible to have security association including all potential mobile and correspondent nodes • No security association between MN and CNs

  27. Return Routability (1/4) • Return Routability • Authorizes binding procedure by the use of a cryptographic token exchange • Terminologies • Cookie • random number used by a mobile nodes • To prevent spoofing by a bogus CN in the RR procedure • Care-of init cookie • a cookie sent to the CN in the Care-of Test Init message, to be returned in the Care-of Test message • Home init cookie • a cookie sent to the CN in the Home Test Init message, to be returned in the Home Test message

  28. Return Routability (2/4) • Terminologies • Keygen Token • number supplied by a CN in the RR procedure to enable the MN to compute the necessary binding management key for authorizing a BU • Care-of keygen token: Care-of Test message • Home keygen token: Home Test message • Nonce • random numbers used internally by the CN in the creation of keygen tokens related to the RR procedure • Binding management key (kbm) • Key used for authorizing a binding cache management message (e.g., BU and BACK messages) • RR provides a way to create a binding management key

  29. Return Routability (3/4) • Home Test Init (HoTI) • MN sends a Home Test Init message to the CN to acquire the home keygen token • Source Address = home address • Destination Address = CN • Parameters • Home init cookie • This message is reverse tunneled through the HA • Care-of Test Init (CoTI) • MN sends a Care-of Test Init message to the CN to acquire the care-of keygen token • Source Address = CoA • This message is sent directly to the CN

  30. Return Routability (4/4) • Home Test (HoT) • Sent in response to a Home Test Init message • Source Address = CN • Destination Address = home address • Parameters • Home init cookie • Home keygen token • First(64, HMAC_SHA1 (Kcn, (home address|nonce|0) ) ) • Home nonce index • Care-of Test (CoT) • kbm = SHA1(home keygen token|care-of keygen token) • BU:HMAC_SHA1(kbm, (care-of address|CN address |BU) )

  31. Home Agent <Care-Of Address> Mobile Node Return Routability Test (1/3) Secret Key: <Kcn> Temporary Nonces: 1 - <nonce1>2 - <nonce2> ... Correspondent Node <care-of keygen token> = HMAC_SHA1Kcn (<care-of-address> | <nonce1> | 1) [1:64]<care-of init cookie> <Correspondent Address> Care-of Test Init:src=<care-of address> dst=<correspondent address><care-of init cookie> Care-of Test:src=<correspondent address>dst=<care-of address> <care-of init cookie> <care-of keygen token> care-of nonce index: 1 Cookies:<care-of init cookie> <care-of keygen token> care-of nonce index: 1

  32. Home Agent <Care-Of Address> Mobile Node Return Routability Test (2/3) Secret Key: <Kcn> Temporary Nonces: 1 - <nonce1>2 - <nonce2> ... Correspondent Node <home keygen token> = HMAC_SHA1Kcn (<home-address> | <nonce1> | 0) [1:64]<home init cookie> <Correspondent Address> Home Test:src=<correspondent address>dst=<home address> <home init cookie> <home keygen token> home nonce index: 1 Home Test Init:src=<home address> dst=<correspondent address><home init cookie> Cookies:<care-of init cookie><care-of keygen token> care-of nonce index: 1 <home init cookie> <home keygen token> home nonce index: 1

  33. Home Agent <Care-Of Address> Mobile Node Return Routability Test (3/3) Secret Key: <Kcn> Temporary Nonces: 1 - <nonce1>2 - <nonce2> ... Correspondent Node <home keygen token> = HMAC_SHA1Kcn (<home-address> | <nonce1> | 0) [1:64]<care-of keygen token> = HMAC_SHA1Kcn (<care-of-address> | <nonce1> | 1) [1:64] <Correspondent Address> Kbm = SHA1(<home-keygen-token> | <care-of keygen token>) MAC = HMAC_SHA1Kbm(<care-of-address>|<correspondent address>|BU) [1:96] Binding Update src=<care-of address> dst=<correspondent address> option: Home Address = <home address> <sequence number> <home nonce index = 1> <care-of nonce index = 1> <MAC> Cookies:<care-of init cookie><care-of keygen token> care-of nonce index: 1<home init cookie> <home keygen token> home nonce index: 1

  34. Mobile IPv6 Optimization

  35. Drawbacks of Mobile IPv6 • Mobile IPv6 • Reacts after L2 movement • Introduces a period of service disruption after L2 movement until signaling is completed • Performance depends on Mobile IP registration time and MH-HA distance • Optimization Schemes • Fast Handover for Mobile IPv6 • Anticipates Mobile IP messaging (before L2 movement) • Hierarchical Mobile IPv6 • Reduces MN to HA round trip delay • Reduces the number of messages (ratio transmission efficiency)

  36. Standardization (1/2) • Recent trend in IETF… • New working groups • MIP4: Mobility for IPv4 • MIP6: Mobility for IPv6 • MIPSHOP: MIPv6 Signaling and Handoff Optimization • IP Mobility Optimizations (Mob Opts) in IRTF • Analysis of Mobile IP Route Optimization considering such parameters as traffic pattern, link conditions, topology etc • Alternative mechanisms for discovering a Mobility Anchor Point (MAP) in Hierarchical Mobile IP (HMIP) • Evaluation of existing and new mechanisms for discovering, and selecting a target base station and/or router for handover

  37. Standardization (2/2) • IETF Mobile IP WG • Mobile IPv4 • Low latency handoff • draft-ietf-mobileip-lowlatency-handoffs-v4-09.txt, June 2004. • Regional registration • draft-ietf-mobileip-reg-tunnel-06.txt, March 2002. • Mobile IPv6 • Fast Handover • draft-ietf-mipshop-fast-mipv6-03.txt , October 2003. • Hierarchical Mobile IPv6 • draft-ietf-mipshop-hmipv6-02.txt , June 2004.

  38. Hierarchical Mobile IPv6

  39. HMIPv6 • Motivation • Reduce the number of Bus when MNs move within a MAP domain • Transparency of the MN’s mobility to CNs • Location Privacy • HMIPv6 • Mobility anchor point (MAP): Local HA • MN acquires two addresses • On-link CoA: LCoA • Regional CoA: RCoA • Reduce Mobile IPv6 signaling load • Improve Handoff delay

  40. HMIPv6 Operation (Home address, RCoA) HA CN Internet Home BU MAP MAP (RCoA, LCoA) MAP domain Local BU oldAR newAR MN

  41. HMIPv6 Operation (Home address, RCoA) HA CN Internet MAP MAP (RCoA, LCoA’) MAP domain Local BU oldAR newAR MN

  42. HMIPv6 Operation (Home address, RCoA’) HA CN Internet Home BU MAP (RCoA’, LCoA’) MAP MAP domain oldAR newAR Local BU MN

  43. Fast Handover for Mobile IPv6

  44. FMIPv6 • Fast Handover for Mobile IPv6 • Minimize packet loss and latency due to handoffs • Critical for real-time services • MN acquires a new CoA and registers with previous AR before get link to new AR • As soon as MN leaves the current link, old AR starts forwarding traffic to new AR • Operation • Detect movement in anticipation (L2 Trigger) • Update old AR (before L2 movement) • Traffic is then forwarded from Old AR to New AR (non-optimal) • The MN must then also update HA and CNs (for optimal routing) • Bicasting can improve performance

  45. New Message Format • Neighbor Discovery Message • Router Solicitation for Proxy Advertisement (RtSolPr) • Proxy Router Advertisement (PrRtAdv) • Inter-Access Router Message • Handover Initiate (HI) • Handover Acknowledge (HACK) • New Mobility Header Message • Fast Binding Update (FBU) • Fast Binding Acknowledgement (FACK) • Fast Neighbor Advertisement (FNA)

  46. Message Flow - Predictive MN PAR NAR L2 trigger RtSolPr PrRtAdv HI FBU HACK FBACK FBACK Disconnect forward packets Connect FNA deliver packets

  47. Message Flow - Reactive MN PAR NAR L2 trigger RtSolPr PrRtAdv Disconnect Connect FNA[FBU] FBU FBACK forward packets deliver packets

  48. Binding Update received by mobility agent/CN New link information Link switching delay (tL) IP connectivity latency (tI) tBU tNew Time Packet reception latency (tP) Packets begin arriving at the new IP address Handover start epoch Neighbor Discovery is completed MN transmission capable; sends Binding Update Timing Diagram (1/2) [MIPv6]

  49. Timing Diagram (2/2) New link information IP connectivity and packet reception latency (tI =tP) L2 trigger (RtSolPr/PrRtAdv, HI/HACK) Binding Update received by mobility agent/CN tBU tL2 Time Link switching delay (tL) tNew Handover start epoch : Forwarding from PAR to NAR (F-BU/F-BACK) Neighbor Discovery is completed MN transmission capable; sends Binding Update Packets begin arriving directly at the new IP address [FMIPv6: Predictive]

  50. Research Issue • HMIPv6 • MAP Selection • Scalability and Fault-tolerant Service • FMIPv6 • Implementation over IEEE 802.11/16/20 • Buffer management • HMIPv6 + FMIPv6 • Integration of HMIPv6 with FMIPv6

More Related