1. Wireless & Mobile Communications
Network Protocols/Mobile IP
Motivation
Data transfer
Encapsulation
Security
IPv6
Problems
DHCP
Ad-hoc networks
Routing protocols
2. MobileIP
• Mobile IP (Internet Protocol) enables the transfer
of information to and from mobile computers,
such as laptops and wireless communications.
• The mobile computer can change its location to a
foreign network and still access and
communicate with and through the mobile
computer's home network.
• The Solaris implementation of Mobile IP supports
only IPv4.
Winter 2001 6.2
3. 6.3
Why Mobile IP?
• What do cellular networks and wireless LANs provide?
– Wireless connectivity
– Mobility at the data link layer
• What is Dynamic Host Configuration Protocol (DHCP)?
– It provides local IP addresses for mobile hosts
– Is not secure
– Does not maintain network connectivity when moving
around
• What they do not provide:
– Transparent connectivity at the network layer
– Mobility with local access
• The difference between mobility and nomadicity!
4. 6.4
What is Mobile IP?
• Mobile IP provides network layer mobility
• Provides seamless roaming
• ‘‘Extends’’ the home network over the entire
Internet
5. 6.5
IP Overview 1/3
• IP Addressing :
– Dotted Decimal Notation: 32 bits (4x8) used to
represent IPv4 addresses - 192.19.241.18
– Network Prefix and Host Portions: p - prefix, h - host,
p + h = 32. If p = 24 then h = 32 - 24 = 8. Using above
address the network prefix will be 192.19.241 and
host will be 18. For those of you familiar with subnet
masks, “p” represents the number of 1’s in the subnet
mask. If p = 24, subnet mask is 255.255.255.0, if p =
26, subnet mask is 255.255.255.192.
6. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.6
IP Overview 2/3
• IP Routing:
– Network prefix is used for routing. Routing tables are used to
look up next hop and the interface on the router that is to be
used.
– In the routing tables we use the following notation:
target/prefix length, e.g., 192.19.241.0/24, or
192.19.241.192/26.
– If two subnet masks/prefixes fit the address, the one with the
largest prefix is chosen for routing. E.g., a router with the
following 3 entries in its table: 7.7.7.99/32 (p=32 host specific)
and 7.7.7.0/24 (0<p<32 network prefix) and 0.0.0.0/0 (p=0
default) will use entry 2 for an IP packet with destination 7.7.7.1
and entry 3 for destination 192.33.14.12.
7. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.7
IP Overview 3/3
• Domain Name System (DNS): used to translate a host
name to an IP address. A host sends a query to a server
to obtain the IP address of a destination of which it only
has the host name.
• Link Layer Addresses - Address Resolution Protocol
(ARP):
– Once a host has the IP address of a destination it then needs
to finds its layer 2 address or the layer 2 address of the next
hop on the path. A broadcast message is sent and the
targeted host responds with its layer 2 address.
– A proxy ARP is a response by a node for another node that
cannot respond at the time the request is made (e.g. the
node is a mobiel node and not on its host net at the time, its
home agent will respond in its stead).
– A gratuitous ARP, is a reply to no ARP request, used by a
node that just joins the network and wants to make its
address known. Can be used by a mobile node upon its
return to its home net.
8. 6.8
Motivation for Mobile IP
• IP Routing
– based on IP destination address, network prefix (e.g. 129.13.42)
determines physical subnet
– change of physical subnet implies change of IP address to have a
topologically correct address (standard IP) or needs special entries in
the routing tables
• Specific routes to end-systems?
– requires changing all routing table entries to forward packets to the
right destination
– does not scale with the number of mobile hosts and frequent changes
in the location, security problems
• Changing the IP-address?
– adjust the host IP address depending on the current location
– almost impossible to find a mobile system, DNS updates take long time
– TCP connections break, security problems
9. 6.9
What Mobile IP does:
• Mobile IP solves the following problems:
– if a node moves without changing its IP address it will be unable to
receive its packets,
– if a node changes its IP address it will have to terminate and restart
its ongoing connections everytime it moves to a new network area
(new network prefix).
• Mobile IP is a routing protocol with a very specific purpose.
• Mobile IP is a network layer solution to node mobility in the
Internet.
• Mobile IP is not a complete solution to mobility, changes to the
transport protocols need to be made for a better solution (i.e.,
the transport layers are unaware of the mobile node’s point of
attachment and it might be useful if, e.g., TCP knew that a
wireless link was being used!).
10. 6.10
Requirements to Mobile IP (RFC 2002)
• Transparency
– mobile end-systems keep their IP address
– continuation of communication after interruption of link possible
– point of connection to the fixed network can be changed
• Compatibility
– support of the same layer 2 protocols as IP
– no changes to current end-systems and routers required
– mobile end-systems can communicate with fixed systems
• Security
– authentication of all registration messages
• Efficiency and scalability
– only little additional messages to the mobile system required
(connection typically via a low bandwidth radio link)
– world-wide support of a large number of mobile systems in the whole
Internet
11. 6.11
Mobile IP Terminology
• Mobile Node (MN)
– system (node) that can change the point of connection
to the network without changing its IP address
• Home Agent (HA)
– system in the home network of the MN, typically a router
– registers the location of the MN, tunnels IP datagrams to the COA
• Foreign Agent (FA)
– system in the current foreign network of the MN, typically a router
– forwards the tunneled datagrams to the MN, typically also the default router for
the MN
• Care-of Address (COA)
– address of the current tunnel end-point for the MN (at FA or MN)
– actual location of the MN from an IP point of view
– can be chosen, e.g., via DHCP
• Correspondent Node (CN)
– communication partner
12. • A foreign agent provides a foreign agent care-
of address through its agent advertisement
messages.
• COA is an IP address of the foreign agent.
• The FA is the endpoint of the tunnel and, on
receiving tunneled datagrams, de-
encapsulates them and delivers the inner
datagram to the mobile node.
13. • In this mode, many mobile nodes can share the same care-of
address.
• reduces demands on the IPv4 address space and can also save
bandwidth
• A mobile node acquires a co-located care-of address as a
local IP address through some external means, which the
mobile node then associates with one of its own network
interfaces.
• The address might be dynamically acquired as a temporary
address by the mobile node, such as through DHCP.
• The address might also be owned by the mobile node as a
long-term address for its use only while visiting some foreign
network.
• When using a co-located care-of address, the mobile node
serves as the endpoint of the tunnel and performs de-
encapsulation of the datagrams tunneled to it.
14. Winter 2001 6.14
Mobile IP Operation: Summary
• Consists of 3 steps:
– Agent discovery,
– Registration, and
– Routing/Tunneling
15. 6.15
Operation Summary 1/3
• Agent Advertisement/Discovery: consists of
broadcast messages used by mobiles to detect
that they have moved and are required to
register with a new FA.
– FAs send agent advertisements
– MNs can solicit for agents if they have not heard an
agent advertisement in awhile or use some other
mechanism to obtain a COA or temp. IP address (e.g.
DHCP).
– MNs know they are home when they recognize their
HA.
16. 6.16
Operation Summary 2/3
• Registration: used by a MN to inform the FA that
it is visiting.
– The new care of address of the MN is sent to the HA.
– Registration expires, duration is negotiated during
registration
– Mobile must re-register before it expires
– All registrations are authenticated
– The MN sends a regristration request in to the FA
which passes it along to the home agent. The HA
responds to the FA which then informs the MN that
all is in order and registration is complete.
17. • Agent advertisements are used to discover the home and foreign
agents while moving from one network area to network.
• The process is similar as when the internet nodes detect routers by
ICMP router discovery protocol (RFC 1256).
• Same RFC 1256 is used for agent discovery with the support of
mobility by attaching special extensions to ICMP messages.
• The Home Agent and Foreign Agent periodically send a router
advertisement ICMP messages in the form of beacon frames.
• Show their willingness to act as Mobile IP routers.
• When the mobile node receives the advertisement;
– it compares the network part of the agent’s IP address with the
network part of its own IP address (Home address).
– A mismatch in network parts indicates that mobile node is in a foreign
network.
18. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.18
Agent advertisement
preference level 1
router address 1
#addresses
type
addr. size lifetime
checksum
COA 1
COA 2
type sequence number
length
0 7 8 15 16 31
24
23
code
preference level 2
router address 2
. . .
registration lifetime
. . .
R B H F M G V reserved
20. Agent Solicitation
• The mobile node can also broadcast an agent solicitation based on
RFC 1256 for router solicitations.
• It will be answered by the foreign agent. A mobile node can search
the foreign agent using agent solicitation.
• To avoid flooding of the network, three solicitations are sent per
second as it enters a new network.
• This gap can be large for dynamic networks with moving mobile
nodes or the app’s which require continuous packet stream.
• If a node does not get reply for agent solicitation, it decreases the
rate of solicitations to avoid flooding of network.
• If the mobile node moves to a network that has no foreign agents or
all the agents are busy it can acquire a temporary address through
DHCP (RFC 2131) .
• The mobile node acts as its own foreign agent and the address
obtained as known as co-located care-of-address.
21. Winter 2001 6.21
• Consists of the delivery of the packets to the
mobile node at its current care of address.
– Sender does not need to know that the
destination is a MN.
– HA intercepts all packets for the MN and passes
them along to MN using a tunnel.
– MN communicates directly with the CN.
– Referred to as Triangle Routing
Routing/Encapsulation/Tunneling
22. Winter 2001 6.22
Example network
mobile end-system
Internet
router
router
router
end-system
FA
HA
MN
home network
foreign
network
(physical home network
for the MN)
(current physical network
for the MN)
CN
23. Winter 2001 6.23
Data transfer to the mobile system
Internet
sender
FA
HA
MN
home network
foreign
network
receiver
1
2
3
1. Sender sends to the IP address of MN,
HA intercepts packet (proxy ARP)
2. HA tunnels packet to COA, here FA,
by encapsulation
3. FA forwards the packet
to the MN
CN
24. Mobile IP topology.
• how a datagram moves from one point to another within the Mobile IP
framework.
• The Internet host sends a datagram to the mobile node by using the mobile node's
home address (normal IP routing process).
• If the mobile node is on its home network, the datagram is delivered through the
normal IP process to the mobile node. Otherwise, the home agent receives the
datagram.
• If the mobile node is on a foreign network, the home agent forwards the datagram
to the foreign agent. The home agent must encapsulate the datagram in an IP-in-
IP manner so that the foreign agent's IP address appears in the outer IP header.
• The foreign agent delivers the datagram to the mobile node.
• Datagrams from the mobile node to the Internet host are sent by using normal IP
routing procedures. If the mobile node is on a foreign network, the packets are
delivered to the foreign agent. The foreign agent forwards the datagram to the
Internet host.
25. • In situations with ingress filtering present, the source address must be
topologically correct for the subnet that the datagram is coming from, or
a router cannot forward the datagram.
• If this scenario is the situation on links between the mobile node and the
correspondent node, the foreign agent needs to provide reverse tunneling
support.
• Then the foreign agent can deliver every datagram that the mobile node
sends to its home agent. The home agent then forwards the datagram
through the path that the datagram would have taken had the mobile
node resided on the home network. This process guarantees that the
source address is correct for all links that the datagram must traverse.
26. Reverse Tunneling
• A reverse tunnel is a tunnel that starts at the mobile node's care-of address and
terminates at the home agent.
27. Winter 2001 6.27
Data transfer from the mobile system
Internet
receiver
FA
HA
MN
home network
foreign
network
sender
1
1. Sender sends to the IP address
of the receiver as usual,
FA works as default router
CN
28. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.28
Overview
CN
router
HA
router
FA
Internet
router
1.
2.
3.
home
network
MN
foreign
network
4.
CN
router
HA
router
FA
Internet
router
home
network
MN
foreign
network
COA
29. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.29
Network integration
• Agent Advertisement Discovery
– HA and FA periodically send advertisement messages into their
physical subnets
– MN listens to these messages and detects, if it is in the home
or a foreign network (standard case for home network)
– MN reads a COA from the FA advertisement messages
• Registration (always limited lifetime!)
– MN signals COA to the HA via the FA, HA acknowledges via FA
to MN
– these actions have to be secured by authentication
• Routing/Encapsulation/Tunneling
– HA advertises the IP address of the MN (as for fixed systems),
i.e. standard routing information
– packets to the MN are sent to the HA,
– independent of changes in COA/FA
30. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.30
Registration
t
MN HA
registration
request
registration
reply
t
MN FA HA
registration
request
registration
request
registration
reply
registration
reply
31. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.31
Mobile IP registration request
home agent
home address
type lifetime
0 7 8 15 16 31
24
23
rsv
identification
COA
extensions . . .
S B DMG V
32. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.32
Processing Registration Messages 1/3
• A MN, depending on which registration scenario it is in, will figure what addresses
to use in the various fields of the Registration request message.
– Link layer addresses are tricky:
• A MN may not use ARP if it is using a FA COA. It needs to use the address of the FA as the
destination address.
• If it is using a collocated COA, then it uses ARP to locate the default router using its COA as
source. Note that if the ‘R’ bit is set is uses the FA address as the destination address.
• For de-registration is uses ARP to locate the HA link address and it uses its own home address
for the ARP message.
– For network layer addresses (i.e., IP addresses):
• It uses the FA address as destination address when using the FA COA and its own home
address as the source address.
• If using a collocated COA it uses its COA as source address and the HA address as destination
address. Note that if the ‘R’ bit is set then is must use the same addresses as for the FA COA
scenario.
• For de-registration it uses its own home address as source and the HA address as destination.
33. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.33
Processing Registration Messages 2/3
• For the FA:
– A FA may refuse a Registration request for a number of reasons:
lifetime too long, authentication failed, requested tunneling not
supported, cannot handle another MN (current load too high).
– If an FA does not refuse the request it relays it to the HA. Relaying is
different from forwading as the FA is required to process the packet
and create new headers.
– Some important fields of the request message are recorded for use
later on: MN link layer address, MN IP address, UDP source port, HA IP
address, identification number and requested lifetime.
– Regarding a Registration reply message, the FA can refuse it and send
a decline to the MN is it finds the reply from the HA to be invalid.
Otherwise it updates its list of visiting MNs and begins acting on
behalf of the MN.
34. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.34
Processing Registration Messages 3/3
• For a HA
– The HA will determine, as the FA did, whether it will
accept the request. If it does not it returns a code in
the reply message indicating the cause of the failed
request.
– If the request is accepted, the reply is sent back by
reversing all the IP addresses and UDP port numbers.
– The HA updates the binding table corresponding to
that MN dependent upon the nature of the request.
35. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.35
Routing/Tunneling 1/5
• Routing a packet to a MN involves the following:
– A router on the home link, possibly the HA, advertises
reachability to the network prefix of the MN’s home
address.
– All packets are therefore routed to the MN’s home
link.
– A HA intercepts the packets for the MN and tunnels a
copy to each COA in the binding table.
– At the foreign link either the MN extracts the packet
(collocated COA) or the FA extracts the packet and
forwards it to the MN.
36. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.36
Routing/Tunneling 2/5
• A HA can use one of two methods to intercept a
MN’s packets:
– The HA is a router with multiple network interfaces. In
that case it advertises reachability to the MN’s home
network prefix.
– The HA is not a router with multiple intefaces. It must
use ARP to receive the MN’s packets. It either
responds to ARP requests on behalf of the MN (proxy
ARP) or uses gratuitous ARPs to inform the home
network that it is receiving the MN’s IP packets. This
is to update any ARP caches that hosts and other
devices might have.
37. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.37
Routing/Tunneling 3/5
• How to ‘fool’ the routing table into handling
tunneled packets at the HA?
– A virtual interface is used to do the encapsulation.
– A packet destined for the MN is handled by the
routing routine as all received IP packets are.
– The routing table has a host specific entry for the
MN. This host specific entry is used to route the
packet to a virtual interface that basically consists
of a process that does encapsulation.
– Once encapsulation has been performed the packet
is sent to be processed by the routing routine again.
This time the destination address is the COA and it
is routed normally.
38. Winter 2001 6.38
Routing/Tunneling 4/5
• How to ‘fool’ the routing table into handling tunneled
packets at the FA?
– The same procedure is used as above.
– A packet coming in with a COA that is one of the FA
addresses’ is handled by the routing routine.
– A host specific address (its own address) in the routing
table points to the higher layers and the packet is passed
on to a virtual interface.
– The virtual interface consists of a process that
decapsulates the packet and re-routes it to the routing
routine.
– The routing routine routes the packet normally based
upon a host specific entry that is the MN’s home address
(for which it has the link layer address!).
39. 6.39
Routing/Tunneling 5/5
• How does a MN route its packets?
– It needs to find a router to send all its packets to.
– It can select a router in one of a number of ways dependent
upon whether it has a FA COA or a collocated COA.
– Having a FA COA does not imply that the MN needs to use it
as its default router for sending packets. It can use any router
that sends advertisements or that is advertised in the Agent
Advertisement message.
– If the MN is using a collocated COA it needs to listen for
router advertisements or is it hears none, use DHCP to find
the default router.
– Determining the link layer address is another issue. Collocated
COA MNs can use ARP. FA COA must note the link layer
address when they receive router advertisements or agent
advertisements.
40. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.40
Encapsulation Process
original IP header original data
new data
new IP header
outer header inner header original data
41. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.41
Types of Encapsulation
• Three types of encapsulation protocols are specified for
Mobile IP:
– IP-in-IP encapsulation: required to be supported. Full IP header
added to the original IP packet. The new header contains HA
address as source and Care of Address as destination.
– Minimal encapsulation: optional. Requires less overhead but
requires changes to the original header. Destination address is
changed to Care of Address and Source IP address is maintained
as is.
– Generic Routing Encapsulation (GRE): optional. Allows packets
of a different protocol suite to be encapsulated by another
protocol suite.
• Type of tunneling/encapsulation supported is indicated in
registration.
42. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.42
IP in IP Encapsulation
• IP in IP encapsulation (mandatory in RFC
2003)
– tunnel between HA and COA
Care-of address COA
IP address of HA
TTL
IP identification
IP-in-IP IP checksum
flags fragment offset
length
TOS
ver. IHL
IP address of MN
IP address of CN
TTL
IP identification
lay. 4 prot. IP checksum
flags fragment offset
length
TOS
ver. IHL
TCP/UDP/ ... payload
43. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.43
Minimum Encapsulation
• Minimal encapsulation (optional)
– avoids repetition of identical fields
– e.g. TTL, IHL, version, TOS
– only applicable for unfragmented packets, no space left for
fragment identification
care-of address COA
IP address of HA
TTL
IP identification
min. encap. IP checksum
flags fragment offset
length
TOS
ver. IHL
IP address of MN
original sender IP address (if S=1)
S
lay. 4 protoc. IP checksum
TCP/UDP/ ... payload
reserved
44. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.44
Generic Routing Encapsulation
original
header
original data
new data
new header
outer header
GRE
header
original data
original
header
Care-of address COA
IP address of HA
TTL
IP identification
GRE IP checksum
flags fragment offset
length
TOS
ver. IHL
IP address of MN
IP address of CN
TTL
IP identification
lay. 4 prot. IP checksum
flags fragment offset
length
TOS
ver. IHL
TCP/UDP/ ... payload
routing (optional)
sequence number (optional)
key (optional)
offset (optional)
checksum (optional)
protocol
rec. rsv. ver.
C R K S s
45. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.45
Routing techniques
• Triangle Routing: tunneling in its simplest form has all
packets go to home network (HA) and then sent to MN via
a tunnel.
– This involves two IP routes that need to be set-up, one original
and the second the tunnel route.
– Causes unnecessary network overhead and adds to the latency.
• Route optimization: allows the correstpondent node to
learn the current location of the MN and tunnel its own
packets directly. Problems arise with
– mobility: correspondent node has to update/maintain its cache.
– authentication: HA has to communicate with the correspondent
node to do authentication, i.e., security association is with HA
not with MN.
46. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.46
Optimization of packet forwarding
• Change of FA
– packets on-the-fly during the change can be lost
– new FA informs old FA to avoid packet loss, old FA
now forwards remaining packets to new FA
– this information also enables the old FA to release
resources for the MN
47. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.47
Change of foreign agent
CN HA FAold
FAnew MN
t
request
update
ACK
data data
MN changes
location
registration
update
ACK
data
data data
warning
update
ACK
data
data
registration
48. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.48
Problems with Triangle Routing
• Triangle routing has the MN correspond directly with
the CN using its home address as the SA
– Firewalls at the foreign network may not allow that
– Multicasting: if a MN is to participate in a multicast group,
it needs to use a reverse tunnel to maintain its association
with the home network.
– TTL: a MN might have a TTL that is suitable for
communication when it is in its HM. This TTL may not be
sufficient when moving around (longer routes possibly).
When using a reverse tunnel, it only counts as a single
hop. A MN does not want to change the TTL everytime it
moves.
• Solution: reverse tunneling
49. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.49
Reverse tunneling (RFC 2344)
Internet
receiver
FA
HA
MN
home network
foreign
network
sender
3
2
1
1. MN sends to FA
2. FA tunnels packets to HA
by encapsulation
3. HA forwards the packet to the
receiver (standard case)
CN
50. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.50
Mobile IP with reverse tunneling
• Routers accept often only “topologically correct“ addresses
(firewall!)
– a packet from the MN encapsulated by the FA is now
topologically correct
• Multicast and TTL problems solved
• Reverse tunneling does not solve
– all problems with firewalls, the reverse tunnel can be abused to
circumvent security mechanisms (tunnel hijacking)
– optimization of data paths, i.e. packets will be forwarded
through the tunnel via the HA to a sender (longer routes)
• The new standard is backwards compatible
– the extensions can be implemented easily
51. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.51
Mobile IP and IPv6
• Mobile IP was developed for IPv4, but IPv6 simplifies the protocols
– security is integrated and not an add-on, authentication of registration is
included
– COA can be assigned via auto-configuration (DHCPv6 is one candidate),
every node has address autoconfiguration
– no need for a separate FA, all routers perform router advertisement
which can be used instead of the special agent advertisement
– MN can signal a sender directly the COA, sending via HA not needed in
this case (automatic path optimization)
– „soft“ hand-over, i.e. without packet loss, between two subnets is
supported
• MN sends the new COA to its old router
• the old router encapsulates all incoming packets for the MN and forwards them to
the new COA
• authentication is always granted
52. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.52
Problems with Mobile IP
• Security
– authentication with FA problematic, for the FA typically belongs to another
organization
– no protocol for key management and key distribution has been standardized in the
Internet
– patent and export restrictions
• Firewalls
– typically mobile IP cannot be used together with firewalls, special set-ups are
needed (such as reverse tunneling)
• QoS
– many new reservations in case of RSVP
– tunneling makes it hard to give a flow of packets a special treatment needed for the
QoS
• Security, firewalls, QoS etc. are topics of current research and discussions!
53. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.53
Security in Mobile IP
• Security requirements (Security Architecture for the Internet Protocol, RFC
1825)
– Integrity
any changes to data between sender and receiver can be detected by the receiver
– Authentication
sender address is really the address of the sender and all data received is really data
sent by this sender
– Confidentiality
only sender and receiver can read the data
– Non-Repudiation
sender cannot deny sending of data
– Traffic Analysis
creation of traffic and user profiles should not be possible
– Replay Protection
receivers can detect replay of messages
54. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.54
not encrypted encrypted
IP security architecture 1/2
• Two or more partners have to negotiate security mechanisms to setup a security association
– typically, all partners choose the same parameters and mechanisms
• Two headers have been defined for securing IP packets:
– Authentication-Header
• guarantees integrity and authenticity of IP packets
• if asymmetric encryption schemes are used, non-repudiation can also be
guaranteed
– Encapsulation Security Payload
• protects confidentiality between communication partners
Authentification-Header
IP-Header UDP/TCP-Paket
authentication header
IP header UDP/TCP data
ESP header
IP header encrypted data
55. Winter 2001 6.55
• Mobile Security Association for registrations
– parameters for the mobile host (MH), home agent (HA), and
foreign agent (FA)
• Extensions of the IP security architecture
– extended authentication of registration
– prevention of replays of registrations
• time stamps: 32 bit time stamps + 32 bit random number
• responses: 32 bit random number (MH) + 32 bit random
number (HA)
registration reply
registration request
registration request
IP security architecture 2/2
MH FA HA
registration reply
MH-HA authentication
MH-FA authentication FA-HA authentication
56. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.56
Key distribution
• Home agent distributes session keys
• foreign agent has a security association with the home agent
• mobile host registers a new binding at the home agent
• home agent answers with a new session key for foreign agent and mobile node
FA MH
HA
response:
EHA-FA {session key}
EHA-MH {session key}
57. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.57
DHCP: Dynamic Host Configuration
Protocol
• Application
– simplification of installation and maintenance of networked computers
– supplies systems with all necessary information, such as IP address, DNS server address,
domain name, subnet mask, default router etc.
– enables automatic integration of systems into an Intranet or the Internet, can be used to
acquire a COA for Mobile IP
• Client/Server-Model
– the client sends via a MAC broadcast a request to the DHCP server (might be via a DHCP
relay)
client relay
client
server
DHCPDISCOVER
DHCPDISCOVER
58. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.58
DHCP - protocol mechanisms
time server
(not selected)
client server
(selected)
initialization
collection of replies
selection of configuration
initialization completed
release
confirmation of
configuration
delete context
determine the
configuration
DHCPDISCOVER
DHCPOFFER
DHCPREQUEST
(reject)
DHCPACK
DHCPRELEASE
DHCPDISCOVER
DHCPOFFER
DHCPREQUEST
(options)
determine the
configuration
59. Winter 2001 ICS 243E - Ch 6 Net. Protocols 6.59
DHCP characteristics
• Server
– several servers can be configured for DHCP, coordination not yet
standardized (i.e., manual configuration)
• Renewal of configurations
– IP addresses have to be requested periodically, simplified protocol
• Options
– available for routers, subnet mask, NTP (network time protocol)
timeserver, SLP (service location protocol) directory,
DNS (domain name system)
• Big security problems!
– no authentication of DHCP information specified
