MIT6: IP and Mobility

Extend of mobility
- Intra-cell mobility:
  - PHY layer
- Inter-cell but Intra-network mobility: (micro mobility)
  - local routing / switching
  - No change of IP
- Inter-network mobility: (macro mobility)
  - change of IP
  - handled by special mobility signaling protocols

Mobile IP (MIP)

TCP/IP: developed for non-mobile, single-homed host
IP: location, identity
no secure

\(\Rightarrow\) Mobility: mobile IP
\(\Rightarrow\) Security: IPSec
Mobility
- IP: determines physical subnet
- routing tables not scalable
- IP changes \(\Rightarrow\) breaks transport layer connections
Requirement
- Transparency: mobile device keeps IP
- compatibility: No change in existing routing / devices
- Security: authenticated
- Efficiency and scalability

Concepts: \(\text{basic ID + location ID}\)

components
- Mobile Node(MN)
- Home Agent (HA)
  - home network router
  - manages MN
  - tunnels IP packets to this locatoin (COA)
- Foreign Agent (FA)
  - foreign network router
  - forwarding tunneled IP packet to MN
  - provides COA
- Care-of Address (COA)
  - valid address of MN
    - managed by FA
    - assigned by MN (co-located COA) (via DHCP)
- Correspondent Node (CN)
CN\(\rightarrow\) MN
- CN\(\rightarrow\) HA \(\xrightarrow[to\ COA]{\text{encapsulation}}\) FA \(\rightarrow\) MN
MN\(\rightarrow\) CN
- MN \(\rightarrow\) FA \(\rightarrow\) CN
Network Integration
- Agent Advertisement: HA, FA periodically announce their existence
- Registration: MN \(\xrightarrow[\text{via FA}]{\text{COA}}\) HA
  (protected by anthentication)
- Local Advertisement: HA \(\xrightarrow[\text{as its own addr.}]{\text{IP addr. of MN}}\) access router
  - packet to MN: sent to HA
  - independent of changes in COA
  - HA \(\xrightarrow[]{\text{packet}}\) COA
  \(\Rightarrow\) simpler interaction
Encapsulation:
- \((\text{2}^{\text{nd}} \text{ payload}(\text{1}^{\text{st}} \text{ packet}))\)
- IP-in-IP-encapsulation
  - tunnel between HA and COA
- minimal encapsulation
  - avoid repetition of identical fields
  - only for unfragmented packets
- most flexible encapsulation
Optimization of Data Path
- Problem: Triangular Routing
  - CN \(\xrightarrow[]{\text{all packets}}\) HA \(\rightarrow\) MN
  - especially: MN \(\leftrightarrow\) MN
- Solution: Change of FA
  - CN learns (from HA) current location of MN (route optimization)
  - (MN registers to new FA new COA)
    New FA informs old FA about new COA
  - old FA: forwards packets, can delete the MN's registration information
Further problem
1. firewall
  - often enforce topologically correct addresses
2. multicast
  - MN cannot answer
3. TTL
  - TTL varies from different locations
4. security
  - CN can learn address of FA
  - CN can track MN
- Solution: Reverse Tunneling
  MN\(\rightarrow\) FA \(\require{extpfeil}\Newextarrow{\xRightarrow}{5,5}{0x21D2}\xRightarrow[]{\text{encapsulation}}\) HA \(\rightarrow\) CN
  - Solves Problems 1.2.3.
  - new problems:
    - double triangular routing
    - Security: FA intrudes home network
Mobile IP and IPv6
- IPv6 can simplify mobility support
- Security
- Automatic path optimization:
  - IPv6 extension headers
- "Soft" handover
  - without packet loss
IPv6 extension header
- Routing
- Destination
Route optimization is mandatory in MIPv6
- CN, MN: binding update

MIP is designed to deal with user mobility
but security, performance

Host Identity Protocol (HIP)

MIP v.s. HIP
- MIP:
  - support for un-modified CN
  - insfrastructure support (FA,HA)
  - indirect mobility management
  - Triangular routing
- HIP:
  - end-to-en association
  - HIP-aware end-host
  - direct mobility management
  - Authentication, end-to-end security
  - no infrastructure support needed
HIP:
- Signaling and key exchange protocol
  \(\text{control channel + payload channel}\)
- namespace: cryptographic \(\Rightarrow\) mobility, multi-homing
Identifier / locator split
- Problem: tight coupling between network / transport layers
\(\Rightarrow\) seperation of location (IPv4, IPv6) and identity (HIP)
- applications see stable identity
- routing: locator
- \[\text{IP}\xleftarrow[control]{\text{IP}}\text{HIP}\xrightarrow[payload]{\text{HI}}\text{TCP/UDP}\]
  - IP can change
  - HI (Host Identity) is static
  - Network changes hidden from TCP layer
Cryptographic namespace
- Host authentication
- Self-generate private / public key pair
  - HI: public key
Globally unique / locally unique Identifiers
- Host Identity Tag (HIT)
  - \(\text{HIT = hash (HI)}\)
  - IPv6
- Local Scope Identity (LSI)
  - \(\text{LSI = Last digits (HIT)}\)
  - IPv4
  - Restricted to local scope

IPSec: Internet Protocol Security

Encryption
- Encapsulated Security Payload (ESP)
- Authentication Header (AH)
mode
- Transport mode
- Tunnel mode
replay protection: sequence number
No key exchange protocol
IPSec transport mode with ESP
- end-to-end
- create secure tunnel between two hosts
- ESP header:
  - Security Parameter Index (SPI): required for multiplexing
  - suquence number
IPSec tunnel mode with ESP
- gateways
- possible to combine with HIP
- Inner header: communiting end-hosts
  Outer header: tunnel end-points
IPSec Bound End-to-end Tunnel (BEET) mode with ESP
- IPSec mode + HIP
- Syntactics (表面上): transport mode
  Semantics (意義上): tunnel mode
- address translation defined by HIP
  - Inner IP: HIP host ID
  - Outer IP: routable IP address
Mobility \(\leftrightarrow\) Security
- authentication
- re-authentication
- DoS
\(\rightarrow\) careful protocol design
Information in HIP message
- Host Identity
- Sig
- Diffie-Hellman
- HMAC
- IPSec info
- Puzzle: cryptographic puzzle parameter

Update

Ubtain new IP address
Transmit new address to peers
Peer varifies routability
Peers adjust IPSec tunnel
Payload uses adjusted tunnel

IPSec rekeying, mobility, multi-homing

Locator: generalization of a network address
Credit-based authentication
- Mobility \(\rightarrow\) redirection-based flooding attacks
\(\Rightarrow\) Credit-based authentication (CBA)
- Idea: limit data rate
  - credit = number of bytes received from IP address of the peer
  - only send packet if credit suffices
  - credit aging decreases

Multi-homing

extension of mobility
host connected through two or more interfaces
multi-homing \(\xrightarrow[]{corresponds}\) mobility signaling
- inform peers locator parameter
- peer runs reachability check
- Multi-homed host can also send locator during BEX
Infrastructure:
- Original: Direct
- middleboxes: indirect
  - NAT: compensation for lack of IPv4 addresses
  - Firewall: security
  - QoS and Proxy: performance
Legacy Middleboxes and HIP
- Strong (theoretical) advantage of HIP architecture
\(\Rightarrow\) But middleboxes can affect HIP packet delivery
- support only limited set of protocols
\(\Rightarrow\) need to create support for lagacy middlebox traversal
HIP strategy for lagacy middlebox traversal
- UDP encapsulation for HIP and payload
  - UDP understood by majority of middleboxes
\(\Rightarrow\) but header overhead, more complex solutions needed

PISA

WiFi drawback
- Threats to mobile node:
  - AP MITM attacks, eavesdropping
- Threats to AP:
  - illegal mobile node
  - Access AP's LAN
- No roaming between APs
WiFi: trust relations
- Transitive trust relation
  - Mobile guest
  - Community Operator
  - Host AP
  Home AP not included
PISA: Peer-to-peer-based Wi-Fi Internet Sharing Architecture
- Securely relocate internet access \(\rightarrow\) MN's home
  \[\text{AP provider}\require{extpfeil}\Newextarrow{\xLeftrightarrow} {5,5}{0x21D4}\xLeftrightarrow[]{\text{encrypted tunnel}}\text{mobile guest}\]
  - security, privacy
  - transparent moibility support
  - Solve legal liability (法律責任) problem
  - Scalable, decentralized solution
- Global mobility and security by
  - HIP
  - Indirection via "Trusted host"
  - Encrypted tunnel
- PISA: trust relations
  - \(\text{community}\require{mhchem}\ce{<=>[\text{trust}][\text{attest membership (certificate)}]}\xRightleftharpoons[\text{trust}]{\text{attest membership (certificate)}}\text{Host AP}\)
  - \(\text{Host AP}\require{extpfeil}\Newextarrow{\xLeftrightarrow} {5,5}{0x21D4}\xLeftrightarrow[\text{trust}]{\text{transitive}}\text{Home AP}\)
  - \(\text{Home AP}\require{extpfeil}\Newextarrow{\xLeftrightarrow} {5,5}{0x21D4}\xLeftrightarrow[\text{trust}]{\text{strong}}\text{Mobile guest}\)
  - \(\text{Host AP}\dashrightarrow\text{Mobile guest}\)
    No trust necessary between Host AP and Mobile guest \(\Rightarrow\) data encryption
Authentication of Trust Point
- \(\text{Initiator}\require{extpfeil}\Newextarrow{\xLeftrightarrow} {5,5}{0x21D4}\xLeftrightarrow[\text{Authentication}]{\text{Mutual}}\text{Responder}\)
- PISA extends HIP handshake
  - no seperate handshake protocol
  - fewer packet, low latency, less complexity
Mobility with PISA
- PISA extends HIP mobility
  - Authentication towards TP
  - Host AP can inject nonce and puzzle to enforce Home AP to proof its identification
Roaming \(\Rightarrow\) Delay
- AP discovery
- DHCP
- authentication
- mobility signaling
Parallel scanning \(\Rightarrow\) detecting APs on adjacent channels
Neighbour detection and coordination
- Handover optimization
- Load balancing
- Channel assignments
Pre-authentication / Pre-configuration
- Neighbour APs
- Enable TP and AP to assist handovers
MOBIKE
- Mobility and Multihoming extension for IKEv2
  - VPN: remotely connect to home network, protected by IPSec in tunnel mode
  - Problem: change of access network \(\Rightarrow\) change of IPSec SAs
  - Solution: MOBIKE

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`	在筆記中貼入程式碼
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.