# Presentation: 669872

## Securing Mobile Networks in an Operational Setting

- Will Ivancic
- _[wivancic@grc.nasa.gov](mailto:wivancic@grc.nasa.gov)_
- (216) 433-3494

## Outline

- Security Considerations
- Neah Bay Project
- Cost of Connectivity
- NASA’s Mobile Network Needs

## Security Considerations

## Securing Networks 

- Constraints/Tools
- Policy
- Security Policy
- Education
- Enforcement
- Architecture
- Protocols
- Must be done up front to be done well

## IPv4 Utopian Operation

**Public**
**Internet**

**FA**

**MR**

**US Coast Guard**
**Mobile Network**

**HA**

**US Coast Guard**
**Operational Network**
**(Private Address Space)**

**CN**

- Triangular Routing

## IPv4 “Real World” Operation

**Public**
**Internet**

**FA**

**MR**

**US Coast Guard**
**Mobile Network**

**HA**

**US Coast Guard**
**Operational Network**
**(Private Address Space)**

**CN**

- P
- R
- O
- X
- y

## Current Solution – Reverse Tunneling

**Public**
**Internet**

**FA**

**MR**

**US Coast Guard**
**Mobile Network**

**HA**

**US Coast Guard**
**Operational Network**
**(Private Address Space)**

**CN**

- Current Solution – Reverse Tunneling

- P
- R
- O
- X
- y

- Anticipate similar problems for IPv6.

- Adds Overhead and kills route optimization.

## Security

- Security     Bandwidth Utilization 
- Security     Performance 
- Tunnels Tunnels Tunnels and more Tunnels
- Performance    Security 
-  User turns OFF Security to make system usable!
- Thus, we need more bandwidth to ensure security.

## Conclusions Regarding Security

- Security Breaks Everything 
- At least it sometimes feels like that.
- “The Ultimate Denial of Service Attack” – D.S.
- Need to change policy where appropriate.
- Need to develop good architectures that consider how the wireless systems and protocols operate.
- Possible solutions that should be investigated:
- Dynamic, protocol-aware firewalls and proxies.
- Possibly incorporated with Authentication and Authorization.

## Neah Bay / Mobile Router Project 

## Neah Bay / Mobile Router Project

## Why NASA/USCG/Industry

- Real world deployment issues can only be addressed in an operational network.
- USCG has immediate needs, therefore willingness to work the problem.
- USCG has military network requirements.
- USCG is large enough network to force us to investigate full scale deployment issues
- USCG is small enough to work with.
- NASA has same network issues regarding mobility, security, network management and scalability.

## Mobile-Router Advantages

- Share wireless and network resources with other organizations
- $$$ savings
- Set and forget
- No onsite expertise required
- However, you still have to engineer the network
- Continuous Connectivity
- (May or may not be important to your organization)
- Robust
- Secondary Home Agent (Dynamic HA)

## Mobile Network Design Goals

- Secure
- Scalable
- Manageable
- Ability to sharing network infrastructure
- Robust

## Shared Network Infrastructure

## Secondary Home Agent(Dynamic HA)

- Secondary Home Agent(Dynamic HA)

**Primary**
**Home Agent**

**Reparenting Home Agent**
**Helps resolve triangular routing**
**Problem over long distances**

## Emergency Backup(Hub / Spoke Network)

## Secondary Home Agent(Fully Meshed Network)

- 1

- 2

- 3

- 4

- 5

## We Are Running with Reverse Tunneling

- Pros
- Ensures topologically correct addresses on foreign networks
- Required as requests from MR LAN hosts must pass through Proxy inside main firewall
- Greatly simplifies setup and management of security associations in encryptors
- Greatly simplifies multicast – HA makes for an excellent rendezvous point.
- Mobile Router does NOT have to be in public address space so long as the Collocated Care-of-Address is.
- Cons
- Uses additional bandwidth
- Destroys route optimization

## Internet

**Internet**

**Globalstar link uses**
**Collocated COA**

**FA - CLEVELAND**

**HA**

**FA - DETROIT**

**Open Internet to HA**

**Satellite Antenna**
**System**

**VOIP**

**VOIP**

**Encr**

**Encr**

**USCG**
**Intranet**

**Ameritech**
**DSL / with Subnet**

**GlobalStar**
**Network**
**(NATing from Public to Private)**

**HA**
**(Loopback has Public Address)**

**Public Address**

**MR**
**(Loopback has Public Address)**

**Neah Bay**
**(Protected LAN)**

**APKnet**
**DSL / with Subnet**

## Encrypted Network

**Mobile**
**LAN**
**10.x.x.x**

**INTERNET**

**FA - Detroit**

**FA **
**Cleveland**

**HA**

**Encryption**

**Encryption**

**802.11b link**

**FIREWALL**

**Public Address**

**USCG Officer’s Club**

**EAST**

**WEST**

**Dock**

**EAST**

**WEST**

**Dock**

**Encrypted Network**
**Data Transfers**

## Use and Deployments

- 1st Demonstrated August 23 & November 6, 2002
- Used in operational setting July – Sept 2003
- New York and Boston Harbor
- NY had no land line
- Boston land line was poor – switched to satellite
- Used Oct – Nov 2003 at shipyard during maintenance
- 802.11b at 11 Mbps

## Operational System

**MR**
**Public**

**Mobile**
**LAN**
**10.x.x.x**

**FA – Cleveland**
**Private**

**HA**
**Public**

**PROXY**

**PIX-506**

**802.11b link**

**FA - Detroit**

***Operational System***
- Home Agent is incorporated
- with the firewall and proxy

- With Acceptable
- Encryption

## Slide 24

## Maintaining Two Networks

**HA**

**Private**
**Leased Line**

**Fed Bldg**
**Router**

**MR**

**Neah Bay LAN **

**Dockside**
**Router**

**Umbilical Cord**
**(Connected When Docked)**

- RIPv2

**Maintaining Two Networks**
**(Routing over Layer-3 Encryptors)**

**Mobile **
**Router**

**Foreign**
**Agent**

- ICMP
- Router
- Discovery

## Globalstar/Sea Tel MCM-8

- Initial market addresses maritime and pleasure boaters.
- Client / Server architecture – *a common architecture*
- Current implementation requires call to be initiated by client (ship).
- Multiplexes eight channels to obtain 56 kbps total data throughput.
- Full bandwidth-on-demand.
- Requires use of Collocated Care-of-Address

## Satellite Coverage

**Globalstar**

**From SaVi**

**INMARSAT**

## Link Performance Considerations

**128 kbps**

## Cost of Connectivity (Examples)

## Deployment issues (mobile)

- Equipment Costs
- Service Cost
- Network Peculiarities
- Network Address Translators
- Performance Enhancing Proxies
- Security Mechanisms
- Packet Filtering
- Connection Mechanisms
- Smart Card Authentication
- MAC and/or Static Key
- (manual login is unacceptable)

## NASA’s Mobile Network Needs

- Space-based systems
- Aeronautics (in partnership with FAA)
- Weather Dissemination
- Air Traffic Management
- Free Flight
- Terrestrial (surface) Systems
- Rovers
- Astronauts

## Earth Observation

## Sensor Web

**Notes:**
Our vision is to leverage the explosive growth of the telecommunications industry through industry’s impressive technology advancements and potential new commercial satellite systems to provide global, interoperable,seamless  connectivity to NASA missions.  These technology products will leverage commercially provided capabilities to support inter-orbital, inter-satellite links with commercial space networks, intra-network links within science spacecraft constellations, while operating with terrestrial networks  AS much as possible, future communications systems architectures will draw on existing and planned commercial satellite constellations and ground based infrastructures to meet NASA's needs.  Using future NASA systems in conjunction with anticipated commercial space networks at higher frequencies  will provide higher rate capability and enable reduction in component size, thereby reducing NASA mission development and operational costs.

## Pick “Papers and Presentations” at http://roland.grc.nasa.gov/~ivancic/ 

- Pick “Papers and Presentations” at http://roland.grc.nasa.gov/~ivancic/

- Neah Bay

## Backup Slides

## Networks in Motion (NEMO) Experiments

- IPv4
- &
- IPv6

## Slide 37

## Slide 38

## Secure Mobile LAN

**Secure Mobile LAN**

**Mobile **
**Router**

**Corresponding**
**Public Node**

**Corresponding**
**Private Node**

**Home**
**Agent**

## Secure Mobile LAN

**Secure Mobile LAN**

**Mobile **
**Router**

**Corresponding**
**Public Node**

**Corresponding**
**Private Node**

**Home**
**Agent**

## Secure Mobile LAN

**Secure Mobile LAN**

**Mobile **
**Router**

**Corresponding**
**Public Node**

**Corresponding**
**Private Node**

**Home**
**Agent**

## Secure Mobile LAN

**Secure Mobile LAN**

**Mobile **
**Router**

**Corresponding**
**Public Node**

**Corresponding**
**Private Node**

**Home**
**Agent**

## Secure Mobile LAN

**Secure Mobile LAN**

**Mobile **
**Router**

**Corresponding**
**Public Node**

**Corresponding**
**Private Node**

**Home**
**Agent**

## Ouch!

**Mobile **
**Router**

**Foreign**
**Agent**

## Slide 45

## Slide 46

## Layer 2 Technology

**Globalstar**
**MCM-8**

**Hypergain**
**802.11b**
**Flat Panel**

**8 dBi**
**Dipole**

**L3-Comm**
**15 dBic**
**Tracking Antenna**

**Sea Tel Tracking Antenna**

## Mobile

**Mobile**
**LAN**
**10.x.x.x**

**INTERNET**

**FA - Detroit**

**FA – Cleveland**

**HA**

**Encryption**

**Encryption**

**802.11b link**

**FIREWALL**

**Public Address**

## Open Network

**Mobile**
**LAN**
**10.x.x.x**

**INTERNET**

**FA - Detroit**

**FA **
**Cleveland**

**HA**

**Encryption**

**Encryption**

**802.11b link**

**FIREWALL**

**Public Address**

**USCG Officer’s Club**

**EAST**

**WEST**

**Dock**

**EAST**

**WEST**

**Dock**

**Open Network**
**Data Transfers**

## RF Bandwidth

**Mobile**
**LAN**
**10.x.x.x**

**Encryption**

**EAST**

**WEST**

**Dock**

**RF Bandwidth**

**1.0 Mbps  (manually set)**

**1.0 Mbps  (manually set)**

**11.0 Mbps  (auto-negotiated and shared with Officer’s Club)**

**7 Kbps to 56 Kbps in 7 Kbps chunks (1 to 2.5 seconds delay)**

## Wireless Only?

- Wireless can be jammed (intentionally or unintentionally)
- Particularly unlicensed spectrum such as 802.11
- Satellites is a bit harder
- Solution is to find interferer and make them stop.
- You may still want land line connections
- Mobile Routing can be used over land lines.