# Presentation: 874664

## Seamless & Secure Mobility

Nada Golmie 

Advanced Networking Technologies Division
National Institute of Standards and Technologies
Gaithersburg, MD 20899
USA
www.antd.nist.gov

- Nada Golmie
- Advanced Networking Technologies Division
- National Institute of Standards and Technologies
- Gaithersburg, MD 20899
- USA
- www.antd.nist.gov

## Seamless Future Networks

**IP Based Core Networks**

**Media Access Systems**

- Services
- and Applications

- cellular

- Wireline
- DSL/modem

- WLAN

**Interworking **

**Mobility Management **

**Roaming **

**Network of Networks**

## Everyday Usage Scenarios

**Ethernet**

**Wi-Fi**

**Cellular**

**Wi-Fi**

**Wi-Max**

- In the office

- In the car

- Out of Town

**Wi-Fi**

**Wi-Fi**

**Wi-Fi**

**AP1**

**AP2**

**AP3**

## Emergency Response Scenario

- Satellite

- Satellite

- 3G

- WiFi

- 3G

## Military Usage Scenario

- “Always Best Connected”** **

## Mobility Granularity 

- Mobility Granularity

**Horizontal Handover**

**Vertical Handover**

**Multiple Interface Management**

**Multiple Flow Management**

- A handover is initiated when mobile device exits the boundaries of an administrative domain. Single interface is used.

- A mobile device does need to move in order to initiate a handover. Multiple interfaces are required, but use one interface at a time.

- Simultaneous use of multiple interfaces and access
- networks. Association of an application with an interface

- Ability to split individual flows between links with
- respect to the requirements of the flows and the user
- preferences

**Complexity Level**

## Key Challenges 

*Scalability* – roaming from any access network to any other access network (2G, 3G, 4G, Wi-Fi, Wi-Max, Bluetooth, Satellite, Ethernet)
*Standard* handover interfaces – interoperability between different vendor equipment.
*Cross-layer* solutions - extensions to layer 1 & layer 2 functionalities in order to optimize higher layer mobility architectures (MIPv4, MIPv6, SIP).
*QOS *guarantees during handover – no disruption to user traffic:  extreme low latency, signaling messages overhead and processing time, resources and routes setup delay, near-zero handover failures and packet loss rate
*Security* – user maintains the same level of security when roaming across different access networks.

## Access Scalability

- Wide variety of access network technologies including cellular (2G, 2.5G, 3G), wireless (Wi-Fi, Wi-Max, Bluetooth, UWB) and wired (DSL, cable modems, Ethernet)

## Access Media Properties

- Different media and coverage areas from few square meters to hundred of kilometers
- Different architectures and protocols for routing, transport, mobility management
- Different authentication, key management and encryption schemes
- Different services offered and user demands ranging from low-data-rate non-real-time applications, to high-speed real-time multimedia applications.

## Industry and Standards Activities

**UMA Technology**

**Session Initiation Protocol**

**IP Multimedia Subsystem**

**Internet Engineering Task Force**
- Detecting Network Attachment
*Processing Layer 2 Triggers*
- Mip4
*Mobile IP version 6*
- Mip6
*Mobile IP version 4*
- Mipshop
*MIPv6 signaling and Handoff Optimization*
- Mobopts
*IP Mobility optimizations research group*
- Nemo
*Network Mobility*

- Higher
- Layers

**No single standard interface!**

**	****	****	****	****IEEE 802**
- IEEE 802.21
*Media Independent Handovers*
- IEEE 802.11r
*IEEE 802.11 Fast handovers*
- IEEE 802.11u
*Interworking with external networks*
- IEEE 802.20
*Mobile broadband wireless access*

- Layer 2

- Layer 3

## Cross-Layer Protocol Interactions

**Profile Manager**

**Access**

**Media**

**Applications**

**Policy**

**Mobility **
**Decision**

**PHY**

**MAC**

- Link measurements:
-  RSSI, Noise, Interference

- Performance Measure.:
- QOS, ACK

**Handover Layer**

**Network Layer**
-      Mobile IP

- trigger

- trigger

- trigger

**Transport Layer**
**          **SCTP

**Application Layer **
**   ****	**SIP

- trigger

- trigger

- trigger

- Handover support

- What are the mobility architectures considered?
- What are the protocols and messages needed?

- What measurements will be used in the handover decision?
- What are the mobility scenarios envisaged?
- How can mobility performance be evaluated?

## Secure Mobility

**Level 1**

**Level 2**

**Access Net. 1**

**Level 3**

- What additional encryption mechanisms and policies should be applied for secure access network transitions?
-  How to characterize security levels?

**Level 2**

**Level 3**

**Level 1**

**Level 2**

**Level 3**

**Access Net. 2**

**Access Net. 3**

- Eg. GSM

- Eg. Wi-Fi

- Eg. Wi-Max

-  Encryption
-          +
- Authentication

- Integrity Checking
- Confidentiality
- Non-Repudiation
- Authentication
- Authorization

## Comparing Cryptographic Suites 

**CCM-Mode 128 bit AES data authentication**
**ECB mode AES, 128-bit key TEK encryption**

**CBC-Mode 56-bit DES data encryption **
**no data authentication**
**RSA, 1024 TEK encryption**

- Comparing Cryptographic Suites

**CBC-Mode 56-bit DES data encryption **
**no data authentication**
**3-DES,128 TEK encryption**

**No data encryption**
**no data authentication**
**RSA, 1024 TEK encryption**

**No data encryption, **
**no data authentication**
**3-DES,128-bit TEK encryption**

- What are
- possible
- mappings?

- IEEE 802.16

- Security offered by different access network technologies does not compare.

**CCMP data encryption**
**802.1X authentication**
**802.1X key management**

- IEEE 802.11

**WRAP data encryption**
**802.1X authentication**
**802.1X key management**

**TKIP data encryption**
**802.1X authentication**
**802.1X key management**

**WEP-104 data encryption**
**802.1X authentication**
**802.1X key management**

**WEP data encryption**
**802.1X authentication**
**802.1X key management**

**CCMP data encryption**
**802.1X authentication**
**No key management**

**WRAP data encryption**
**802.1X authentication**
**No key management**

**TKIP data encryption**
**802.1X authentication**
**No key management**

**WEP-104 data encryption**
**802.1X authentication**
**No key management**

**WEP data encryption**
**802.1X authentication**
**No key management**

## Factors Impacting Security

- Radio Transmission
- Network Architecture
- Cellular
- Mesh
- Internetworking
- Shared Medium
- CSMA/CA
- Polling
- Cryptography
- Mobility

- 	Changing Network Topology
- 	Limited Energy resources
- Node Association
- Power Save Mode
- Logical channel sensing
- Retransmission
- Fragmentation
- Threat Environment

## Practical Issues in Secure Mobility

- Single administrative domain – pairing of user security levels on different access networks
- Multiple administrative domain – need for (re)authentication
- Lack of quantitative measures for security performance
- Menu driven security options for equipment vendors and service providers increase complexity
- Dependence on threat environment, equipment capabilities and usage scenarios.

##  Project Roadmap

-  Project Roadmap

**Tool Development**

**Protocol Analysis**

**Protocol **
**Development**

**Deliverables**

***Why NIST?***

- Technology Gap
- Lack of measurement tools
- Opportunity
- Lack of standards

**Industry Standards**

**Sponsors**

-  Plug-and-play
- simulations
-    Choice of platform
-    Extensions
-    Abstractions
-  Analytical models
-  Performance Metrics
-  Usage Scenarios

**IEEE 802**
-    > development of standard
-        interfaces
**IETF**
-    > lower layer meas.

- Engage potential
-    customers
- Determine
-    need/requirements
- Advertise program

- Information Assurance
-  Workshop, Feb. 2005

-  Quantify handover
-   performance in terms of
-   latency, loss, signaling,
-   security
-  Identify protocol cross-layer
-   interactions
-  Explore and map lower
-   layer measurements
-  Devise service/ security
-   profiles mappings

-  Mobility architecture
-  Decision algorithms
-   and optimizations
-  Extensions to existing
-    protocols
-  Policy Mapping

- Start

-  Mobility tool &
-   measurement
-   repository
-  Publication of
-   comparative
-   performance
-   analysis results
-  User guidelines
-  Best practices
-  Contributions to
-   Industry standard
-   developments

**Competence**

**Impact**

- Strategic

- Technical

##  An Approach to Secure Mobility

- Transitional Security

- Security Levels Mappings

- Single Admin. Domain

- Multi-Admin. Domain

- Vulnerability analysis:
- - Are there any additional
- threats and weaknesses
- posed by the mobility?
- handover?
-  What are they?
- Under what threat models?
-  How to mitigate them?

- Select two technologies as a starting point: for example 802.11b and 802.16
- Assess vulnerabilities associated with handover scenarios and related threat models
- Identify security levels or tiers based on weakness analysis available for each technology
- Devise security level mappings between different technologies
- Extend the analysis to the multi-administrative domain case

- Identify levels of security based on protocol description and weakness analysis:
- How to map comparable levels of security?
- What additional security policies and mechanisms need to be applied in order
- to maintain the same level of security (or vulnerability)?

- Extensions of vulnerability
- analysis:
- Investigate scenario and
- application specific cases
- - Devise taxonomy

- Extensions of security levels:
- - what are the security policies required for specific mobility and application scenarios?

- Start

**Complexity Level**

- Deliverables are
- in the form:
- Mobility security
- requirements
- Security levels and
- mappings
- User Guidelines
- Lessons learned
- Limits of technology
- Feasibility study

## Secure & Seamless Mobility

**Action Plan**
- Develop plug-and-play mobility simulation platform:
-  Assess state of the art & availability of tools available in the public domain.
-  Build model extensions and abstractions to accurately characterize protocol interactions
- Derive analytical models for evaluating handover latency, and transition blocking probability.
- Devise benchmarks and realistic usage scenarios.
- Devise metrics for quantifying handover performance.
- Devise and evaluate handover protocol optimizations and decision algorithms.
- Devise access link security profiles and mappings across access link technologies.

**Technical Approach**
- Investigate mobility protocols and methods that  characterize & improve their performance.

- Bridging the interconnection gap between heterogeneous and “stovepipe” access network technologies

**Deliverables**
- Contribute to standard group activities such as IETF and IEEE 802: conduct comparative performance evaluation of handover mechanisms being considered in IEEE 802
- Create and maintain a repository of tools, benchmarks and performance metrics on NST Web site.
- Publish performance analysis results in conference / journal articles: characterize implications on handover performance including mobility management, QOS, and security.

-  **Key Questions**
- How to support ***seamless mobility*** across different access network technologies?
- How to maintain ***security*** when handing over a connection from one access link to another access link?