# Presentation: 575252

## Practical Considerations for Securely Deploying Mobility

**Will Ivancic****NASA ****Glenn Research Center****	**** ****(216) 433-3494****	****wivancic@grc.nasa.gov**

## Network Design Triangle

- © 2004 Syzygy Engineering  – Will Ivancic

- 5

## Design Issues

**Host and/or Network Mobility**
**Security Policy**
**Corporate and/or Individual **
**Scalability**
**Handoff Speed**
**Intranet or Internet**
**Own and/or Shared Infrastructure **
**May be an issue even within you own Organization**
**Crossing Autonomous Systems**
**Multi-Homing**
**Multiple Radio Links**
**Varying Multi-homed link characteristics (e.g WiFi, Satellite, GPRS, Low-Rate VHF)**

## Mobile Networking Solutions

**Routing Protocols**
****** ****Route Optimization**
****** ****Convergence Time**
****** ****Sharing Infrastructure – who owns the network?**
**Mobile-IP **
****** ****Route Optimization**
****** ****Convergence Time**
****** ****Sharing Infrastructure**
****** ****Security – Relatively Easy to Secure**
**Domain Name Servers**
****** ****Route Optimization**
****** ****Convergence Time**
****** ****Reliability**

## Mobility at What Layer?

**Layer-2 (Radio Link)**
**Fast and Efficient**
**Proven Technology *****within the same infrastructure***
**Cellular Technology Handoffs **
**WiFi handoffs**
**Layer-3 (Network Layer)**
**Slower Handover between varying networks**
**Layer-3 IP address provides identity**
**Security Issues**
**Need to maintain address**
**Layer-4 (Transport Layer)**
**Research Area**
**Identity not tied to layer-3 IP address**
**Proposed Solutions**
**HIP – Host Identity Protocol**
**SCTP – Stream Control Transport Protocol**

- © 2004 Syzygy Engineering  – Will Ivancic

## Location Identifier

**Location Identifier**

**Internet**

- © 2004 Syzygy Engineering  – Will Ivancic

**Registration**

**Binding Updates**

## IPv4 “Real World” Operation

**Public**
**Internet**

**FA**

**MR**

**US Coast Guard**
**Mobile Network**

**HA**

**US Coast Guard**
**Operational Network**
**(Private Address Space)**

**CN**

**IPv4 “Real World” Operation**

- P
- R
- O
- X
- y

## Current Solution – Reverse Tunneling

**Public**
**Internet**

**FA**

**MR**

**US Coast Guard**
**Mobile Network**

**HA**

**US Coast Guard**
**Operational Network**
**(Private Address Space)**

**CN**

**Current Solution – ****Reverse Tunneling**

- P
- R
- O
- X
- y

- Anticipate similar problems for IPv6.

- Adds Overhead and kills route optimization.

- NAT

- Must Run NAT Transversal Using UDP Tunnels

## Shared Network Infrastructure

**Shared Network Infrastructure**

## x

**Mobile Network**

**Access Router **

**Access Router **

**Home Agent**

**Corresponding Node**

**Basic Mobile Network Support for IPv6**

**Mobile **
**Network**
**Nodes**

**Bidirectional Tunnel**

**Note, **
**Mobile Network allows **
**for single Binding Update.**
**Other Mobility Solutions may **
**Oversubscribe link during **
**Binding updates.**

## Mobile Security

**The Next (Current) **
**Research / Deployment**
**Area **

## Behind Router – Strategic 

**IPE-2M**

**Foreign Agent**** **

**IPE-2M**

**Roaming**
**Interface**

**Behind Router – Strategic**** **

**Home**
**Agent**

**HA-MR Tunnel**

**Mobile Network**

**HA-FA Tunnel**

**IPE-IPE Secure Tunnel**

**Home Network**

- Source – Western DataCom

- Address can
- Be Fixed

- Address
- Changes with
- Mobility

**Notes:**
The Neah Bay is using the IPE in a strategic deployment which refers to the placement of the encryptors, in this case behind the routers.

## In-Front of Router – Tactical 

**IPE-2M**

**Foreign Agent**** **

**IPE-2M**

**Mobile Router**

**Roaming**
**Interface**

**In-Front of Router – Tactical**** **

**Home**
**Agent**

**HA-MR Tunnel**

**Mobile Network**

**HA-FA Tunnel**

**IPE-IPE Secure Tunnel**

**Home Network**

- Source – Western DataCom

- Address
- Changes with
- Mobility

**Notes:**
The Army demonstration uses a tactical deployment which places the IPE in front of the routers.

## Mobile IPSec ? 

**IPSec**
**Device**

**Mobile IPSec ?**** **

**Secure Tunnel**

- Address
- Changes with
- Mobility

**Mobile**
**IPSec**
**Device**

- © 2004 Syzygy Engineering  – Will Ivancic

**Partially Being Addressed**
-  MOBIKE
-  HIP
-  Certificate Based Identity?
- Others?

**Notes:**
The Army demonstration uses a tactical deployment which places the IPE in front of the routers.

## IPv6 Ad Hoc Networking Challenges

**Denial of Service**
**Duplicate Address Detection (DAD) DoS, Uncooperative Router, etc...**
**Neighbor Discovery trust and threats**
**Network Discovery**
**Reachback, DNS, Key Manager**
**Security**
**IPSec / HAIPES tunnel end-points**
**Security Policies in a dynamic environment**
**Is layer-2 encryption sufficient security? **
**Insecure routing**
**Attackers may inject erroneous routing information to divert network traffic, or make routing inefficient**
**Key Management**
**Lack of key distribution mechanism **
**Hard to guarantee access to any particular node (e.g. obtain a secret key)**

- © 2004 Syzygy Engineering  – Will Ivancic

## IPv6 Ad Hoc Networking Challenges

**Duplicate Address Discovery**
**Not suitable for multi-hop ad hoc networks that have dynamic network topology**
**Need to address situation where two MANET partitions merge**
**Radio Technology**
**Layer-2 media access often incompatible with layer-3 MANET routing protocol**
**Battery exhaustion threat**
**A malicious node may interact with a mobile node very often trying to drain the mobile node’s battery**
**Testing of Applications**
**Integrating MANET into the Internet**

- © 2004 Syzygy Engineering  – Will Ivancic