Presentation is loading. Please wait.

Presentation is loading. Please wait.

Mobility Management in IP-Based Wireless Networks.

Similar presentations


Presentation on theme: "Mobility Management in IP-Based Wireless Networks."— Presentation transcript:

1 Mobility Management in IP-Based Wireless Networks

2 1.Basic issues in mobility management 2.Mobility management in IP networks 3.Mobility management in 3GPP packet networks

3 1. Basic Issues in Mobility Management 1.1 Impact of naming and addressing on mobility management 1.2 Location management 1.3 Packet delivery to mobile destinations 1.4 Handoffs 1.5 Roaming

4 Types of Mobility Terminal mobility the ability for a user terminal to continue to access the network when the terminal moves User mobility the ability for a user to continue to access network services, may be from different terminals, under the same user identity when the user moves Service mobility the ability for a user to access the same services regardless of where the user is

5 Basic Mobility Management Requirements Support all forms of mobility Support mobility for all types of applications real-time and non-real-time data, voice, and multimedia applications Support mobility across heterogeneous radio systems in the same or different administrative domains Support session (service) continuity continue without significant interruptions as the user moves about Global roaming the ability for a user to move into and use different operators networks

6 Basic Functional Components Location management a process that enables the network to determine a mobiles current location i.e., the mobiles current network attachment point where the mobile can receive traffic from the network Packet delivery to mobiles a process whereby a network node, mobile terminal, or end-user application uses location information to deliver packets to a mobile terminal

7 Handoff and roaming handoff (or handover) a process in which a mobile terminal changes its network attachment point example: a mobile may be handed off from one wireless base station (or access point) to another, or from one router or switch to another roaming the ability for a user to move into and use different operators networks

8 Network access control a process used by a network provider to determine whether a user is permitted to use a network and/or a specific service provided by the network main steps authentication: verify the identity of user authorization: determine whether a user should be permitted to use a network or a network service accounting: collect information on the resources used by a user

9 1.1 Impact of Naming and Addressing on Mobility Management A name identifies a network entity, such as a user, a user terminal, a network node, or a service An address is a special identifier used by the network to determine where traffic should be routed A terminals address typically identifies a network attachment point a telephone number in a PSTN network identifies a port on a PSTN switch rather than the telephone set itself an IP terminals IP address identifies an attachment point to an IP network

10 Todays networks, the name of a terminal is often tied with the terminals address, example, an IP terminal has traditionally been named by the Internet Domain Name associated with the terminals IP address mobile terminals that use multiple network addresses are becoming increasingly popular, example, a mobile terminal may have multiple radio interfaces each radio interface may use a different type of radio technology each radio interface may need to have its own IP address

11 which domain name should be used as the terminals name in this case? solutions make the IP terminal names independent of the terminals addresses e.g., IETF has defined Network Access Identifier (NAI) that allows a terminal to be identified by a single globally unique NAI regardless of how many IP addresses this terminal may have

12 Traditional circuit-switched networks, such as the PSTN, typically do not support user names they assume a static mapping between a terminal and the user responsible to pay for the services used by the terminal Static mapping of users to terminals could lead to a range of problems in a mobile network mobile users often have to, or like to, use different types of terminals in different locations depending on what types of terminals are available or best fit their needs this suggests that a mobile users name should not be statically tied to a mobile terminal

13 Terminal-independent user names have become increasingly common in mobile networks, example, GSM each subscriber is identified by a globally unique International Mobile Subscriber Identity (IMSI) that is independent of the terminal used by the user a Subscriber Identity Module (SIM) carries a mobiles IMSI and can be ported from one mobile terminal to another to allow a user to use different terminals and still be recognized by the network as the same user

14 Todays IP Networks, applications provide their own naming schemes for users, example users are identified by their addresses SIP users are identified by their SIP URIs the NAI may serve as a users globally unique and terminal-independent user name

15 1.2 Location Management Location update strategies Location discovery (paging) Interactions between location update and paging

16 1.2.1 Location Update Strategies When a mobile should perform location updates and what location-related information the mobile should send to the network? update the mobiles precise location every time the mobile changes its network attachment points, example, Mobile IP knowing a mobiles precise location allows the network to deliver traffic to the mobile via unicast

17 when mobiles change their network attachment points frequently, maintaining precise locations of all mobiles could lead to heavy location update traffic, which wastes limited radio bandwidth to save scarce resources on the mobile and in the wireless network, a network can group network attachment points into location areas only keeps track of which location area each mobile is likely in when the user and the network have no traffic to send to each other the network tries to determine a mobiles precise location only when it needs to deliver user traffic to the mobile

18 Location Update Time-based update update periodically at a constant interval (called update interval) Movement-based update update whenever it traverses a predefined number of location areas, called movement threshold most existing wireless networks (e.g., GSM, GPRS, 3GPP, 3GPP2) use movement-based location update strategy in which the movement threshold is one

19 Distance-based update update whenever it has traveled a predefined distance threshold from the location area in which it performed its last location update distance may be measured in many different ways, such as physical distance, or cell distance (i.e., distance measured in number of radio cells or location areas) the physical distance-based strategy is used, for example, as an option in 3GPP2

20 Parameter-based update update whenever the value of any preselected parameter changes these strategies are sometimes referred to as profile- based strategies this strategy is used, for example, as an option in 3GPP2

21 Implicit update a mobile does not send any message explicitly for the purpose of location update instead, the network derives the mobiles location when the network receives other signaling or user data from the mobile

22 Probabilistic update update based on a probability distribution function a probabilistic version of time-based, movement-based, or distance-based location update strategies may be created example: a time-based location update the new update time interval after each update may be dynamically adjusted based on the probability distribution of call arrival times

23 Movement-Based vs. Distance-Based Location Update Strategies

24 Assumptions the mobile last performed a location update in the center location area the number on each arrowed line indicates the number of times the mobile has crossed a cell boundary the movement threshold used by a movement-based update strategy is three cell boundary crossings the distance threshold used by the distance- based update strategy is three cells

25 Movement-based update strategy update at the third, sixth, and the ninth times it crosses a cell boundary Distance-based update strategy only update once, i.e., at the ninth time it crosses a cell boundary

26 1.2.2 Location Discovery (Paging) Network performs paging send one or multiple paging messages to a paging area where the mobile is likely to be located Upon receiving a paging message a mobile needs to update its precise current location with the network

27 Issues with Paging Paging should be done within a reasonable time constraint if paging takes too long, the call setup latency could become intolerable to end users and call attempts may be dropped How to construct paging areas? paging areas do not have to be identical to location areas How to search a paging area to locate a mobile?

28 Paging Strategies Blanket paging Sequential paging Geographic paging Group paging

29 Blanket Paging Blanket paging is deployed in most of todays wireless networks A paging message is broadcast simultaneously to all radio cells inside the paging area where the mobile is located Advantages simplicity low paging latency Drawback broadcasting paging messages to a large number of radio cells could consume a significant amount of scarce resources, including radio bandwidth and power on all the mobiles in the paging area

30 Blanket Paging Page every cells within the LA

31 Sequential Paging A large paging area is divided into small paging sub-areas (e.g., radio cells) Procedure paging messages are first sent to a subset of the paging areas where the network believes the mobile is most likely to be located if the mobile is not in this sub-area, subsequent paging messages will be sent to another paging sub-area the process continues until either the mobile is found or the entire paging area is searched

32 Sequential Paging Page the cells sequentially until the user is found

33 Issues how to divide a large paging area into smaller paging sub-areas which sub-areas should be searched first

34 Blanket Paging vs. Sequential Paging BlanketSequential paging costlargesmall paging delaysmalllarge sequential group paging may be used if there is a constraint on paging cost

35 Geographic & Group Paging Strategies Geographic paging network uses geographical position of a mobile to determine where a paging message should be sent Group paging to locate a mobile, the network pages a group of mobiles together instead of paging only the mobile to be located

36 1.2.3 Interactions between Location Update and Paging Design of location update and paging strategies should consider a proper balance among the following overhead network resources consumed by location updates and paging performance, e.g., paging latency complexity complexities of location update and paging as well as protocols needed to support these strategies high complexity results in high network costs and high level of difficulty in operating the network

37 1.3 Packet Delivery Strategies to Mobile Destinations Direct delivery strategy a packet originator first obtains the destination mobiles current location (from location servers) then addresses and sends packets directly to that location

38

39 Relayed delivery strategy a packet is sent first to a mobility anchor point the packet is then relayed toward its final destination the packet originator does not need to know the destination mobiles current location whether a destination is a mobile or a fixed node

40

41 Limitations of relayed delivery strategy may cause packets to take longer paths than direct delivery strategies the mobility anchor points could become traffic and performance bottlenecks

42 Integrated relayed delivery and direct delivery strategies packets destined to the destination will be routed first toward a mobility anchor point mobility anchor point relays these packets to mobiles current location the mobility anchor point or the destination then inform the packet originator of the destinations current location the packet originator then address the packets directly to the mobiles current location

43

44 1.4 Handoffs Handoffs in an IP-based wireless network may occur at different protocol layers Handoffs at each protocol layer may occur in different scopes Handoffs can be hard or soft

45 Layers of Handoff Physical layer a mobile changes its network attachment point at the physical layer example: the mobile may change from one radio channel to another, from one wireless base station to another Logical link layer a mobile changes its logical link layer over which the mobile exchanges user IP packets with the network IP layer the mobile changes its IP address or moves to a different IP access router

46 Scopes of Handoff Handoffs at each protocol layer may occur in different scopes Handoffs at the IP layer intra-subnet handoff a mobile remains on the same IP subnet after it changes its IP address or moves from one base station to another

47 inter-subnet handoff a mobile moves into a new IP subnet and changes its IP address inter-router handoff a mobile moves to a new IP access router

48 Types of Handoff Processes Hard handoff a mobile can receive user data from only one base station at any time handoff implementations make-before-break mobile sets up new network attachment before it tears down old network attachment break-before-make mobile tears down old network attachment point and then sets up new network attachment

49 Soft handoff a mobile receives copies of the same user data from two or more base stations simultaneously the mobile uses signal processing techniques to determine the most likely correct value of the data from its multiple copies soft handoff has been proven to be an effective way for increasing the capacity, reliability, and coverage range requires the following capabilities data distribution and selection data content synchronization

50 Data Distribution and Selection BS Mobile separate copies of the same data sent via multiple base stations to the same mobile the mobile should construct a single copy and only pass the copy to upper layer protocols or applications Mobile BS multiple copies of the same user data originated from a mobile sent to network via different base stations the edge devices connecting the radio access networks to the core network should select one copy of the data to send to the destination

51 Data Content Synchronization Mobiles radio system should combine copies of the same data arriving from multiple base stations

52 Selection and Distribution Unit (SDU) Responsible for data distribution from network to mobile May be located on a base station or a MSC Create and distribute multiple streams of the same data over layer-2 circuits to multiple base stations that relay the data to the mobile

53 1.5 Roaming Home domain the domain where the mobile maintains a service subscription account uses users accounts and service profiles to determine how to provide services to a mobile how to charge the services used by the mobile

54 users account subscribers identity billing address service profile security information (for authentication) users service profile the network services subscribed by the user the networks the user is allowed to use

55 Visited domain when a user moves into a domain with which it does not have an account

56 Extra Capabilities Needed to Support Roaming Network access control for visiting mobiles Roaming agreement between mobiles home domain and visited domains Session continuity while a user crosses domain boundaries

57 Network Access Control for Visiting Mobiles Decision on allowing a user to use a visited domain is based on who this user is whether the user or its home domain agrees to pay for its use of the visited domain where to send the bill of this user

58 Roaming Agreement between Mobiles Home Domain and Visited Domains A roaming agreement should decide how a visiting mobile should be authenticated, authorized, and billed The visited domain may ask the users home domain to authenticate the user confirm how to charge for the users use of the visited domain

59 The home domain may send information regarding the users service profile to the visited domain to help the visited domain to determine how to provide services to the user, for example, the users QoS requirements

60

61 Roaming Broker Problem users may roam outside the countries into different network providers in other countries it is difficult for a network provider to establish a roaming agreement with every other network provider One alternative solution is to use a Roaming Broker

62 Roaming broker each network provider only needs to establish a roaming agreement with the roaming broker when a user roams into a new visited network this visited network will ask the roaming broker to authenticate and authorize the user the roaming broker relay the authentication and authorization requests from the mobiles home network provider relay the responses to the mobiles current visited network

63

64 2. Mobility Management in IP Networks 2.1 Naming and addressing of IP terminals 2.2 Mobile IPv4 2.3 MIPv4 regional registration 2.4 Paging extensions to Mobile IPv4 2.5 Mobile IPv6 2.6 SIP-based mobility management 2.7 Cellular IP 2.8 HAWAII

65 Mobile IPv4 (or MIPv4) standard protocol defined by IETF for mobility management in IPv4 networks enables an IP terminal to maintain a permanent IP address and receive packets addressed to this permanent address regardless of the mobiles current attachment point to the Internet Mobile IPv6 (MIPv6) the IETF is leveraging MIPv4 to define an IP-layer mobility management protocol for IPv6 networks

66 Micromobility management protocols IP-layer mobility protocols that provide enhanced mobility support (e.g., reduced handoff delay) within a limited geographical region E.g., a building, campus, or a metropolitan area network Examples of micromobility management protocols MIPv4 Regional Registration Cellular IP HAWAII

67 SIP-based mobility management the most widely accepted application-layer mobility protocol as the session management protocol for wireline and wireless IP networks

68 2.1 Naming and Addressing of IP Terminals Issues with regular IP routing protocols, when a terminal moves to a new IP network or IP subnet (visited or foreign network) the terminal have to use an new IP address of the new IP network in order to receive packets from the visited network if the mobile terminal uses its IP address as its identifier, the identifier will change as the mobile moves from one IP network to another

69 ‚a mobile may have multiple radio interfaces, each with a different IP address a mobiles radio interfaces may not all be reachable by the network at any given time depending on which radio systems are available at the mobiles current location or which radio system the mobile user wishes to use if multiple radio systems are available this makes it difficult to determine which IP address configured on the mobile should be used as the mobiles identifier

70 Resolution Network Access Identifier (NAI) IETF defined NAI that can identify a mobile terminal (or user) regardless of either the terminals current location or how many IP addresses the terminal may have

71 NAI form username identifies the terminal realm identifies the Internet domain name of a Network Access Server (NAS)

72 Note: Network Access Server (NAS) A single point of access to a remote resource Act as a gateway to guard access to a protected resource this can be anything from a telephone network, to printers, to the Internet Operations the client connects to the NAS the NAS then connects to another resource asking whether the client's supplied credentials are valid based on that answer the NAS then allows or disallows access to the protected resource

73 NAS contains no information about what clients can connect or what credentials are valid all the NAS does is send the credentials the client supplied to a resource which does know how to process the credentials Associated protocols although not required, NAS are almost exclusively used with AAA servers RADIUS tends to be the most widely used DIAMETER base protocol extends RADIUS services by providing error handling and inter-domain communications this protocol is used in networks like IP Multimedia Subsystem (IMS)

74 2.2 Mobile IPv4 Mobility issues in IP Networks once a mobile terminal moves to a new subnet, a correspondent node needs to use the mobiles new IP address it is difficult to force every possible correspondent node to keep track when a mobile terminal may change its IP address and what the mobiles new address will be changing IP address will cause on-going TCP sessions to break

75 Mobility management should ensure on-going TCP connection does not break restore quickly if TCP connection breaks

76 Home Network Home address a globally unique and routable IP address preconfigured or dynamically assigned Home network the network whose network address prefix matches that of the mobile terminals home address Home agent (HA) maintain up-to-date location information for the mobile intercept packets addressed to the mobiles home address tunnel packets to the mobiles current location

77 Note: Network Prefix Class A Network (/8 Prefixes) Class B Networks (/16 Prefixes) Class C Networks (/24 Prefixes) NetworkHost A: NetworkHost B: NetworkHost C:

78 78 IP addresses are divided into three different classes each of the following figure defines different-sized network and host parts there are also class D addresses specify a multicast group, and class E addresses that are currently unused in all cases, the address is 32 bits long

79 79 NetworkHost A: NetworkHost B: NetworkHost C: IP addresses: (a) class A; (b) class B; (c) class C

80 80 the class of an IP address is identified in the most significant few bits if the first bit is 0, it is a class A address if the first bit is 1 and the second is 0, it is a class B if the first two bits are 1 and the third is 0, it is a class C address of the approximately 4 billion (= 2 32 ) possible IP addresses one-half are class A one-quarter are class B one-eighth are class C

81 81 Class A addresses 7 bits for the network part and 24 bits for the host part 126 (= ) class A networks (0 and 127 are reserved) each network can accommodate up to (about 16 million) hosts (again, two are reserved values) Class B addresses 14 bits for the network part and 16 bits for the host part 65,534 (= ) hosts

82 82 Class C addresses 21 bits for the network part and 8 bits for the host part 2,097,152 (= 2 2l ) class C networks 254 hosts (host identifier 255 is reserved for broadcast, and 0 is not a valid host number)

83 83 IP addresses are written as four decimal integers separated by dots each integer represents the decimal value contained in 1 byte (= 0~255) of the address, starting at the most significant Example, Internet domain names (DNS) also hierarchical domain names tend to be ASCII strings separated by dots, e.g., cs.nccu.edu.tw

84 Foreign Network Care-of Address (CoA) assigned to the mobile by the foreign network a mobile uses its CoA to receive IP packets in the foreign network

85 Foreign agent (FA) provides CoAs and other necessary configuration information (e.g., address of default IP router) to visiting mobiles de-tunnels packets from the tunnel sent from a visiting mobiles HA and then delivers the packets to the visiting mobile acts as the IP default router for packets sent by visiting mobile terminals helps visiting mobiles to determine whether they have moved into a different network

86 Two Types of CoAs in MIPv4 Foreign Agent CoA an IP address of a FA each FA is responsible for providing FA CoAs to visiting mobiles when FA CoA is used, the mobiles HA tunnels the packets to the mobiles current FA that addressed to the mobiles home address the FA will then de-tunnel the packets and deliver them to the mobile

87

88 Co-located CoA a CoA acquired by a mobile terminal through any method external to Mobile IP example, a mobile may use the Dynamic Host Configuration Protocol (DHCP) to obtain a temporary address dynamically the mobile terminals HA tunnels the packets addressed to the mobiles home address directly to the mobile itself; these packets do not have to go through any FA

89

90 Main Phases of MIPv4 Operation Agent discovery Movement detection Leaving the home network Entering and staying in a visited network Returning to the home network

91 2.2.1 Agent discovery Movement detection Leaving the home network Entering and staying in a visited network Returning to the home network Mobile-home authentication extension Vendor/organization specific extensions to Mobile IP messages Reverse tunneling Limitations of MIPv MIPv4 route optimization

92 2.2.1 Agent Discovery Goal for a mobile terminal to discover mobility agents (home agent and foreign agent) Approach mobility agents advertise services and system information to mobiles via Agent Advertisement messages a mobile may solicit an Agent Advertisement message from any mobility agents by sending an Agent Solicitation message to the Mobile-Agents Multicast Group address all mobility agents should respond to any received Agent Solicitation message

93 Agent discovery using Internet Control Message Protocol (ICMP) Router Discovery Messages ICMP Router Advertisement Message sent by router to terminals to inform its IP address ICMP Router Solicitation Message sent by a terminal to ask router to send ICMP Router Advertisement Messages

94 Agent Advertisement Message ICMP Router Advertisement message with extensions to carry MIPv4 specific information Mobility Agent Advertisement Extension indicate this is a MIPv4 Agent Advertisement message carry information specific to MIPv4 mobility agent Prefix-Lengths Extension (optional) indicate the network prefix length (in bits) of each advertised Router Address mobile may use this prefix lengths to determine whether it has moved into a new IP network

95 Structure of Mobile IP Agent Advertisement Message

96 MIPv4 Mobility Agent Advertisement Extension to ICMP Router Advertisement Message

97 Fields and Flags Type 16, indicates a Mobility Agent Advertisement Extension Length length in octets of the extension from the beginning of Sequence Number field to the end Sequence Number number of Agent Advertisement messages sent since the agent was initiated Registration Lifetime longest lifetime in seconds the agent is willing to accept any Registration Request

98 R (Registration required) set, if Mobile IP registration through this FA is required B (Busy) set, if this FA will not accept registrations from additional mobile terminals H (Home agent) set, if this agent offers service as a HA F (Foreign agent) set, if this agent offers service as a FA

99 M (Minimal encapsulation - RFC 2004 ) set, if this agent can accept tunneled messages that use Minimal Encapsulation G (GRE encapsulation - RFC 3095 ) set, if this agent accepts tunneled packets that use Generic Routing Encapsulation (GRE) r (Reserved) this field is not used must be set to zero and ignored on reception

100 T (Reverse tunneling) set, if this FA supports reverse tunneling Reserved not currently used and shall be ignored by the mobiles Foreign Agent Care-of Addresses addresses, if any, provided by this FA

101 MIPv4 Prefix-Length Extension to ICMP Router Advertisement message

102 Fields Type 19, indicates a Prefix-Length Extension Length the value of the Num Addrs field in the ICMP Router Advertisement portion of the Agent Advertisement indicating the number of Router Addresses advertised in this message Prefix Lengths the number of leading bits that define the network prefix of the corresponding Router Address encoded as a separate byte, in the order that the Router Addresses are listed in the ICMP Router Advertisement portion

103 Agent Solicitation Message The format is identical to ICMP Router Solicitation message, except its IP Time-to-Live (TTL) must be set to 1, means that Agent Solicitation message will not propagate beyond local IP subnet

104 2.2.2 Movement Detection For a mobile to detect whether it enters a new IP subnet (changes its care-of address) Approach 1 use the Lifetime field in Agent Advertisement messages Lifetime indicates the length of time that this Advertisement is valid

105 Algorithm if the mobile does not receive any new Agent Advertisement from the same mobility agent within the remaining Lifetime it will assume that it has lost contact with that mobility agent if, by this time, the mobile has already received Agent Advertisement from other mobility agents it may use one of these mobility agents otherwise, the mobile should start searching for a new mobility agent by issuing Agent Solicitation messages

106 Approach 2 a mobile may compare the network prefix of old network with that of new IP subnet if the two network prefixes differ then it means the mobile has just entered a new IP subnet

107 2.2.3 Leaving the Home Network As a mobile leaves its home network the HA captures the packets addressed to the mobiles home address ARP (Address Resolution Protocol) used to determine the hardware address associated with a target IP address hardware address identify a node at the link layer used by link layer protocol to forward link-layer frames or packets ex Medium Access Control (MAC) address

108 ARP protocol when a node wants to send an IP packet to a target node and does not know its hardware address it broadcasts an ARP REQUEST message (include sender IP address, target IP address, sender hardware address) to ask all the nodes on the local IP network for the target nodes hardware address that matches target IP address

109 the node that matches the target IP address will reply with ARP REPLY message including its IP address and hardware address once a node learns the mapping from an IP address to a hardware address, the node caches the mapping in its ARP cache for later use

110 Issues & Resolutions Issue-1 after a mobile leaves its home network, other nodes on the home network may still have cached the mapping of the mobiles IP address to its hardware address those nodes will continue to send packets to the mobiles hardware address rather than to the HA, and thus these packets will be lost

111 Resolution-1 (Gratuitous ARP) a Gratuitous ARP packet, can be an ARP REQUEST packet, is sent by a node to trigger other nodes to update their ARP caches before a mobile leaves its home network it broadcasts a Gratuitous ARP packet to all other nodes (including mobility agents) on the local IP subnet

112 those nodes that receives such a Gratuitous ARP packet will update its ARP cache to map the sending mobiles home address to the HAs hardware address these nodes will forward future packets addressed to the mobiles home address to the mobiles HA

113 Issue-2 if a node on a mobiles home network does not have the mobiles hardware address in its ARP cache when it wants to send a packet to the mobile, this node will use ARP to find the mobiles hardware address however, when the mobile is away from the home network, the mobile will not be able to reply to the ARP REQUESTs sent by nodes on the home network

114 Resolution-2 (Proxy ARP) a Proxy ARP packet is an ARP REPLY message sent by one node on behalf of another node in response to an ARP REQUEST when the HA receives an ARP REQUEST asking for hardware address of the mobile that is away from the home network, the HA will reply to this ARP REQUEST on behalf of the mobile

115 the HA will set the Sender Protocol Address (IP address) and the Sender Hardware Address of this ARP REPLY message to the HAs own IP and hardware addresses, respectively those nodes that receive the ARP REPLY message will forward packets addressed to the mobiles home address to the HA

116 2.2.4 Entering and Staying in a Visited Network Upon entering a visited network a mobile must acquire a temporary CoA from the visited network to receive packets from the visited network the mobile will then register its new CoA with its HA this registration serves as a location update and will cause the HA to tunnel packets addressed to the mobiles home address to this new CoA

117 Two messages for registration Registration Request Registration Reply Registration Request and Registration Reply messages are transported over UDP to a port number 434

118 Registration request & reply a mobile sends a Registration Request message to its HA to register its current CoA upon receiving a Registration Request message, the HA authenticates the mobile if the authentication is positive, the HA will use this CoA to update the mobiles CoA the HA will then return a Registration Reply message to the mobile

119 A mobile may register its current CoA with its HA directly send Registration Request messages directly to the HA without having to go through a FA through a FA send Registration Request messages first to a FA and then forward them to the mobiles HA

120

121 Mutual authentication HA authenticates all Registration Requests it receives mobile authenticates all Registration Reply messages it receives

122 protections against a range of security attacks redirection attack protect against malicious users from sending Registration Requests to a HA to cause packets to another redirected mobile user denial of service (DOS) protect a malicious user from pretending to be a HA to conduct denial of service attacks by rejecting its Registration Requests

123 MIPv4 Registration Request Message Format

124 Fields and Flags Type 1, indicate whether this is a MIPv4 Registration Request S (Simultaneous bindings) set, if a mobile requests its HA to maintain multiple care-of addresses for the mobile at the same time when the HA intercepts a packet addressed to the mobiles home address, it will tunnel a copy of the packet to each currently registered care-of address

125 B (Broadcast datagrams) set, if the mobile requests that the HA tunnel to it any broadcast datagrams that it receives on the home network D (Decapsulation by mobile terminal) set, if the mobile will itself decapsulate datagrams that are sent to the co-located care-of address

126 M (Minimal encapsulation) set, if the mobile requests that its HA use Minimal Encapsulation for datagrams tunneled to the mobile G (GRE encapsulation) set, if the mobile requests that its HA use GRE encapsulation for datagrams tunneled to the mobile node r set to zero and ignored on reception not used for any other purpose

127 T reverse tunneling requested x set to zero and ignored on reception not used for any other purpose Lifetime number of seconds remained before registration is expired a zero lifetime indicates a request for deregistration

128 Home Address if a mobile has a preconfigured home address it may put its home address in the Home Address field

129 if the mobile does not have a preconfigured home address the mobile sets the Home Address field to the mobile should specify its NAI (Network Access Identifier) in the Registration Request message

130 Home Agent if the mobile knows the address of its HA the Home Agent field contains the IP address of the mobiles HA if the mobile does not know the address of its HA use Dynamic Home Agent Address Resolution to discover the HAs address

131 Care-of Address the mobiles CoA Identification a 64-bit number used for protecting against replay attacks of registration messages by matching Registration Requests (mobile) with Registration Replies (HA)

132 Extension one or more extension fields used to support future enhancement Mobile-Home Authentication Extension a mandatory extension in every Registration Request message used by HA to authenticate Registration Request

133 MIPv4 Registration Reply Message Format

134 Fields Type 3, indicate whether this is a MIPv4 Registration Reply message Code indicate the result of the corresponding Registration Request

135 Lifetime for successful registration contain the number of seconds remained before registration is expired for failed registration should be ignored 0 indicate that the mobile has been deregistered

136 Home Address the mobiles home address Home Agent the IP address of the mobiles HA Identification a 64-bit number used for protecting against replay attacks of registration messages by matching Registration Requests (mobile) with Registration Replies (HA)

137 Extension Mobile-Home Authentication Extension a mandatory extensions field to be carried in every Registration Reply message used by a mobile to authenticate the Registration Reply message

138 2.2.5 Returning to the Home Network When a mobile returns to its home network packets addressed to its home address will now be forwarded to itself directly, rather than to its HA Two steps to take those nodes on the home network, which cache IP- to-hardware address binding, will start to send packets directly to the mobile rather than to the HA the mobile should inform its HA to remove the obsolete states for the mobile

139 2.2.6 Mobile-Home Authentication Extension Used to authenticate Registration Request and Registration Reply messages

140 Mobile-Home Authentication Extensions to Mobile IP Messages

141 Fields Type 32, indicate a Mobile-Home Authentication Extension Length length in octets of the extension from the beginning of the SPI field to the end Security Parameter Index (SPI) a four-octet identifier used to identify a security context between a mobile and its HA SPI identifies the authentication algorithm and the secret used by the mobile and its HA to compute the Authenticator

142 Authenticator a number calculated by applying an authentication algorithm on the message that needs to be protected protect the following fields of a Registration Request or a Registration Reply message the data of the Registration Request or the Registration Reply all other Extensions to the Registration Request or the Registration Reply message prior to the Mobile- Home Authentication Extension the Type, Length, and SPI fields of this Mobile- Home Authentication Extension

143 Fields Protected by MIP Mobile-Home Authentication Extension

144 2.2.7 Vendor/Organization Specific Extensions to Mobile IP Messages Allow network equipment vendors and other organizations (e.g., network operators) to add their specific information to the Mobile IP signaling messages (i.e., Registration Request, Registration Reply, Agent Advertisement messages) implement creative mobility control capabilities in addition to the basic mobility control capabilities

145 Two Vendor/Organization Specific Extensions have been defined in IETF RFC 3115 Critical Vendor/Organization Specific Extensions (CVSE) Normal Vendor/Organization Specific Extensions (NVSE)

146 Critical Vendor/Organization Specific Extensions (CVSE)

147 CVSE Fields Type 37, the CVSE-TYPE-NUMBER Reserved reserved for future use set to 0 by the sender and must be ignored on reception Length length in bytes of this extension, not including the Type and Length bytes

148 Vendor/Org-ID the identifier of the vendor or organization that is using this extension Vendor-CVSE-Type the particular type of this CVSE a vendor may assign and use different types of CVSEs

149 Vendor-CVSE-Value vendor/organization-specific data it may contain zero or more octets

150 Normal Vendor/Organization Specific Extensions (NVSE)

151 NVSE Fields Type 133, the NVSE-TYPE-NUMBER Length length in bytes of this extension, not including the Type and Length bytes Reserved reserved for future use set to 0 by the sender and must be ignored on reception

152 Vendor/Org-ID the identifier of the vendor or organization that is using this extension Vendor-NVSE-Type the particular type of this NVSE a vendor may assign and use different types of NVSEs

153 Vendor-NVSE-Value vendor/organization-specific data it may contain zero or more octets

154 2.2.8 Reverse Tunneling Reverse tunneling tunnel a mobiles outgoing packets from the mobiles CoA back to the mobiles HA the HA will then decapsulate the packets and route the original packets to their final destinations

155 IETF RFC 3024 specifies how reverse tunneling works when a mobile uses Foreign Agent CoA a mobile arrives at a visited network listen for Agent Advertisement messages select a FA that supports reverse tunnels

156 a FA informs visiting mobiles that it supports reverse tunneling by setting the T flag in the Agent Advertisement messages it sends to the mobiles the mobile requests the reverse tunneling service when it registers through the selected FA by setting the T flag in the MIPv4 Registration Request

157 Two ways for a visiting mobile to deliver packets to FA direct delivery style the mobile designate the FA as its default router send packets directly to the FA without encapsulation

158 the FA intercept these packets tunnel them over the reverse tunnel to the mobiles HA

159 encapsulate delivery style the mobile encapsulate all its outgoing packets send the encapsulated packets to the FA the FA decapsulate these packets tunnel them over the reverse tunnel to the mobiles HA

160 Mobile IPv4 Reverse Tunneling

161 2.2.9 Limitations of MIPv4 [Limitation-1] Triangular routing packets addressed to a mobiles home address routed to the mobiles HA first forwarded to the mobiles current care-of address could introduce long end-to-end packet delays and lead to inefficient use of network resource solution route optimization

162 [Limitation-2] HA may become a traffic and performance bottleneck all user traffic destined to a mobile outside its home network have to go through the mobiles HA this makes a HA a potential traffic and performance bottleneck as the number of mobiles and/or the traffic volume grow

163 [Limitation-3] Potential long handoff delay when a mobile changes its CoA (e.g., handoffs to another IP subnet), it has to register its new CoA with its HA if the foreign network is far away from the mobiles home network could introduce a long delay registration process may be unacceptable to on-going real-time sessions of voice or multimedia applications solution micromobility management protocols

164 [Limitation-4] Potential insufficient deregistration capability after a mobile is registered through a FA, the mobile may move into a new network in basic MIPv4, the mobile does not explicitly deregister with the FA in the old network this registration expires only when its lifetime expires its difficult for a visited network to determine when a mobile left the network

165 [Limitation-5] Insufficient capabilities to support other mobility management requirements example, current MIPv4 does not support dormant mobiles a dormant mobile exchanges limited information infrequently with network in order to save scarce resources (e.g., power) network may not know the precise location of this dormant mobile

166 network needs to perform paging to determine the mobiles precise location when it has packets to send solution to support dormant mobile terminals, IP paging protocols are required

167 MIPv4 Route Optimization A correspondent node knows a mobiles current CoA tunnel packets to the destination mobiles CoA directly A correspondent host may maintain a Binding Cache that maps the mobiles home addresses to their CoAs When a packet is to be sent, the correspondent host will first search its Binding Cache for the mobiles CoA if the search is found, the correspondent host will tunnel the packets to the mobiles CoA directly otherwise, it will send the packet to the mobiles home address as in the basic MIPv4

168 MIPv4 Route Optimization

169 2.3 MIPv4 Regional Registration Problem a mobile has to register with its HA every time it changes its CoA this could introduce long handoff delay when the visited network is far away from the mobiles home network

170 MIPv4 Regional Registration extend the basic MIPv4 protocol to allow a mobile to register its new CoA locally with its visited network domain network domain a collection of networks sharing a common network administration

171 MIPv4 Regional Registration

172 Each network domain consists of a two-level hierarchy of FAs top level Gateway Foreign Agents (GFAs) each domain will have at least one GFA GFAs are the FAs that directly interact with visiting mobiles HAs outside the domain a GFA must have a publicly routable IP address lower level any number of FAs

173 A mobile inside a visited domain will have two CoAs GFA address: the mobile will register the address of a GFA in the visited domain as its CoA with its HA local CoA: a local CoA is an address used by the mobile to receive packets over a network inside the visited domain MIPv4 Agent Advertisement message is extended to include a flag I to indicate whether the domain supports MIPv4 Regional Registration

174 The mobile can learn the GFA address in one of the following ways from Agent Advertisement messages these messages are extended to carry GFA address dynamically assigned by visited network the mobile sets the CoA field in its Registration Request to zero to require the visited network to dynamically assign it with a GFA address

175 FA will add the following extensions to the received Registration Request message and then relay this message with the added extensions to the GFA a GFA IP Address Extension contain the address of the assigned GFA a Hierarchical Foreign Agent Extension contain the address of the FA

176 MIPv4 Regional Registration introduces two new messages Regional Registration Request mobile FA GFA initiate regional registration Regional Registration Reply GFA mobile respond to a Regional Registration Request

177 2.4 Paging Extensions to Mobile IPv4 Mobile IP can be extended to support paging P-MIP (Paging in Mobile IP) is one set of paging extensions to Mobile IPv4

178 P-MIP mobile a mobile can be in active or idle state active state mobile operates in the same manner as in standard Mobile IP without P-MIP idle state mobile may not perform MIP registration

179 a mobile uses an Active Timer to determine whether it should be in active or idle state it stays in active state for an Active Timer period and changes into idle state when its Active Timer expires each time a mobile sends or receives a packet, it restarts its Active Timer an idle mobile transitions into active state whenever it receives or sends any packet

180 Registered FA the FA through which a mobile performed its last Mobile IP registration use an Active Timer to determine whether the mobile is active or idle each time this FA sends a packet to or receives a packet from the mobile, it restarts the Active Timer for the mobile

181 P-MIP requirement an FA is required on each IP subnet mobiles can only use FA CoAs and have to perform Mobile IP registration through FAs Paging Areas FAs are grouped into Paging Areas each Paging Areas is identified by a unique Paging Area Identifier (PAI)

182 Requirement of MIP registration No if an idle mobile moves from one IP subnet to another inside the same paging area Yes if an idle mobile moves into a new paging area

183 Paging Extensions to Mobile IPv4

184 P-MIP procedure (deliver packets to idle mobiles) sending packets mobiles HA mobiles CoA (the mobiles Registered FA) Registered FA checks if the mobile is active or idle mobiles home address

185 if the mobile is active mobile's Registered FA will forward the packets over its own local network directly to the mobile if the mobile is idle mobile's Registered FA will broadcast a Paging Request over its own local network, and unicast a Paging Request to every FA in the same Paging Area

186 note there is no requirement of MIP registration if an idle mobile moves from one IP subnet to another inside the same paging area when an idle mobile receives a Paging Request, it will transit into active mode

187 Limitations on Active Timers setting of Active Timer value of Active Timer depends on the application traffic example, value of Active Timer of sending and receiving a stream of packets should be longer than that of inter-packet arrival, so that no extra paging will be needed before the last packet of the packet stream is received by the mobile

188 different applications generate different types of traffic with widely varying inter-packet arrival times mobiles should dynamically adjust the value of Active Timer by sending signaling messages to inform its Registered FA of the new Active Timer value

189 ‚consistency of Active Timers the value of the Active Timer maintained on the mobile should be about the same as that used by the mobiles Registered FA this requires an FA to know the value of the Active Timer for each mobile preconfigure such Active Timer values on all FAs for every mobile does not seem to be a scalable approach

190 2.5 Mobile IPv6 Mobile IPv6 use the same concepts of home networks and home addresses as in MIPv4 ensure that a mobile can receive packets addressed to its home address regardless of where it is make a mobiles movement transparent to upper layer protocols and applications

191 Basic concept mobile has a home network and a home address mobiles home address does not need to change regardless of where the mobile is correspondent node can always address packets to a mobiles home address

192 when a mobile moves into a foreign network it acquires a IPv6 CoA to receive packets from foreign network by registering its current CoA with its HA binding association between a mobiles home address and its CoA

193 MIPv6 Address Binding with Home Agent

194 Address binding as a mobile changes its CoA mobile sends a Binding Update (BU) message to its HA to register its current CoA HA returns a Binding Acknowledgment (BA) message to inform the mobile of the status of the Binding Update

195 Authentication HA authenticates every BU message it receives mobile authenticates every BA it receives authentication of BU and BA messages is achieved using IPsec

196 IP Security (IPsec) IETF develops IP Security (IPsec) to secure IP packet transmissions IPsec provides data origin authentication, replay protection, data integrity, data confidentiality, and access control IPsec is a suite of protocols for protecting IP datagrams and higher-layer protocols

197 it consists of security protocols, authentication and encryption algorithms, security associations, and key management IPsec is optional for IPv4 but mandatory in IPv6

198 Security protocols Authentication Header (AH) support data integrity and authentication of packets Encapsulating Security Payload (ESP) mainly provide confidentiality services, including confidentiality of message content and limited traffic flow confidentiality

199 Family of IPsec Protocols

200 Note: Security Different facets of network security authentication an ability for communicating parties, including network operators and users, to validate each others authentic identity authorization the ability for a party (e.g., a network provider) to determine whether a user should be allowed to access particular networks, network services, or information also referred to as access control integrity protection of information from unauthorized change

201 confidentiality or privacy keep the information private such that only authorized users can understand it confidentiality is also referred to as privacy confidentiality is often achieved by encryption availability the network operators should prevent outside malicious users from blocking legitimate access to a network or a network service denial-of-service, for example, will deter legitimate users from accessing the network information and resources

202 nonrepudiation the ability for a network to supply undeniable evidence to prove the message transmission and network access performed by a user

203 Security attacks (active attack) denial-of-service (DoS) prevent a service from being provided to one or more users or to cause significant disruptions to the services example, an attacker may initiate a large number of connections to a target destination continuously to overload the target to make it impossible or difficult for the target to provide any service legitimate users, therefore, are deterred from network access

204 masquerade an attacker first acquires the identity of a legitimate user it then pretends to be an authorized user to access the network information and resources man-in-the-middle an attacker positions forces between communicating parties to intercept and manipulate the messages transmitted between the communicating parties example, the attacker may delay, modify, or counterfeit the messages

205 the attacker may also divert the messages to other locations before relaying them between the legitimate communicating parties before such attacks are detected, the legitimate communicating parties believe that they are still sending messages to each other directly replay an attacker intercepts and records the legitimate transmission the attacker then replays (i.e., resends) the messages later on

206 using replay attacks, an attacker could pretend to be an authorized user to access a network or information even when the captured transmission was encrypted and even when the attacker does not know the security key needed to decrypt the captured transmission example, an attacker could replay a banking transaction to duplicate the previous transaction

207 MIPv6 does not use FAs in IPv6 network, mobiles use only co-located CoAs, and no need of FA CoAs mobiles can use IPv6 Neighbor Discovery to detect movement MIPv6 supports two modes of operation bi-directional tunneling mode route optimization mode

208 MIPv6 Bi-directional Tunneling Mode Similar to how MIPv4 works when using a co-located CoA It treats a mobile destination in exactly the same way it treats a fixed destination Correspondent host sends packets to mobile it always uses the mobiles home address as the destination address

209 packets will be routed via regular IPv6 routing to mobiles home network if the mobile is inside its home network packets will be delivered to mobile via regular IPv6 routing protocols without MIPv6 if the mobile is outside its home network HA intercepts the packets tunnel packets to mobile

210

211 Mobile sends packets to correspondent host while a mobile is away from its home network packets are tunneled to mobiles HA first HA then uses regular IPv6 routing to route these packets toward their final destinations

212 MIPv6 Route Optimization Mode Operation a mobile will register its binding not only with its HA but also with its correspondent hosts packets from a correspondent host can be routed directly to the CoA of the destination mobile

213

214 Before a correspondent host has the binding for a mobile it will address packets to mobiles home address initial packets are tunneled by HA to the mobile mobile can then send binding to correspondent host for it to sent future packets directly to mobile

215 To support route optimization MIPv6 requires each IPv6 host and MIPv6 HA to use a binding cache to maintain binding information when an IPv6 terminal wishes to send packets to another IPv6 terminal, it first checks its binding cache to see if it has a binding for the destination if it does, packets are addressed to the destinations CoA directly if it does not, packets are addressed to the destinations home address

216 2.5.1 Movement Detection The basic approach used by an IPv6 mobile for movement detection is IPv6 Neighbor Discovery IPv6 Neighbor Discovery enables an IPv6 terminal to discover new IPv6 routers and determine if a router is reachable (i.e., terminal and router can receive packets from each other) an IPv6 router broadcasts Router Advertisement messages to mobiles on that local network

217 these advertisement messages carry the IPv6 addresses of the router and network prefixes that can be used by mobiles to configure their CoA help a mobile to discover new IPv6 routers also help a mobile to detect whether an IPv6 router is still reachable, i.e. whether it has moved out of a network or moved into a new network

218 A mobile can probe the network to see if there are reachable routers by broadcasting Neighbor Solicitation messages upon receiving such message, a router will send Router Advertisement messages to the mobile

219 A mobile may use other means to help movement detection example, a handoff at the lower layer (e.g., change of radio channels, radio cells, or radio interfaces on the mobile) can be used as an indication that the mobile may have moved into a new IP network

220 A mobile can acquire an IPv6 CoA by using auto-configuration combine a network prefix received in the Router Advertisement messages with the mobiles own hardware address DHCPv6

221 2.5.2 Sending Packets Directly to Mobiles Care-of Address When a correspondent host has a binding for a mobile the host can address packets directly to the mobiles CoA In IPv6, a routing header is used by a source node to list one or more nodes that should process the packet (or the nodes to be visited by the packet), in addition to the node identified by the destination address in the packet header

222 A routing header is inserted between the IPv6 header and the header of upper layer protocol (e.g., UDP or TCP)

223 IPv6 Packet

224 Next Header (8 bits) (10 ) 0Hop By Hop Option Header 6TCP 17UDP 41Capsule IPv6 Header 43Routing Header 44Fragment Header 46Resource Reservation Protocol 50Security Payload Capsule Header (RFC2406) 51Authentication Header (RFC2402) 58ICMPv6 59No Next Header 60Destination Option Header

225 IPv6

226 When a correspondent host sends a packet directly to a mobile it uses the mobiles CoA as the destination address in the IPv6 header of the packet the mobiles home address will be carried in a routing header defined by MIPv6 When the packet arrives at the destination mobiles CoA it will process the routing header and know where is the mobiles home address CoAHome address IPv6 headerRouting header

227 it replaces the IPv6 destination address in the IPv6 header with the mobiles home address decrements the Segments Left field in the routing header by one 0, indicating that the mobiles home address is the final destination IPv6 header Home address

228 MIPv6 Routing Header Format

229 Fields Next Header 8-bit code identifies the type of header immediately following the routing header Header Extension Length 8-bit unsigned integer indicates the length of the routing header in eight- octect units, not including the first eight octets Routing Type type of the routing header

230 Segments left 8-bit unsigned integer indicates the number of nodes listed in this routing header that are still to be visited 1, this MIPv6 routing header will carry only a single home address

231 Reserved 32-bit field reserved for future use Home Address home address of the destination mobile

232 2.5.3 Sending Packets while Away from Home When a mobile is away from its home network and wants to send a packet to a correspondent host or the mobiles HA the mobile may use its current CoA as the source address in the packet header and pass to the access routers in a visited network without using reverse tunneling

233 MIPv6 uses IPv6 Destination Options Header Header carries optional information to be examined only by destination node Header is placed between IPv6 header and the header of upper layer protocols (e.g., UPD)

234 MIPv6 defines a Home Address Option that will be carried inside an IPv6 Destination Option Header when a mobile is away from its home network and wants to send a packet, it uses the Home Address Option to inform the packets recipient of the mobiles home address

235 Format of IPv6 Destination Options Header Carrying a Mobile IPv6 Home Address Option

236 Fields Next Header 8-bit code identifies the type of header immediately following the destination options header Header Extension Length 8-bit unsigned integer indicates the length of the destination options header in eight-octect units, not including the first eight octets

237 Option Type identifies the type of the Option carried in IPv6 Destination Options Header 201, defined by MIPv6 Option Length 8-bit unsigned integer indicates the length of the Home Address Option in octets, excluding the Option Type field and the Option Length field

238 Home Address the home address of the mobile sending the packet

239 When a correspondent host (or a HA) receives a packet that carries a MIPv6 Home Address Option if it does not have a binding entry for the home address carried in Home Address Option it drops the packet if it has a binding entry for the home address it replaces the source address in the packet header with the home address carried in the Home Address Option

240 2.5.4 Formats of Binding Update and Binding Acknowledgment Messages MIPv6 Binding Update (BU) and Binding Acknowledgment (BA) messages transported inside a special IPv6 extension header, the Mobility Header defined by MIPv6 Mobility Header placed between IPv6 header and upper layer protocol (e.g., UDP or TCP) header of a user IPv6 packet

241 Mobile IPv6 Mobility Header

242 Fields Payload Protocol 8-bit value identifies the type of the header immediately following the Mobility Header Header Length 8-bit unsigned integer represents the length of the Mobility Header in units of octets, excluding the first eight octets must be a multiple of eight octets

243 Mobility Header Type 8-bit value identifies the type of mobility message in the Message Data field Reserved 8-bit field reserved for future use

244 Checksum 16-bit unsigned integer checksum of the Mobility Header Message Data a variable-length field contains a specific mobility message, such as a BU message or a BA message Note a checksum is a form of redundancy check, a very simple measure for protecting the integrity of data by detecting errors in data

245 Format of Mobile IPv6 Binding Update message

246 Fields Sequence Number 16-bit unsigned integer used by receiving node to sequence BU messages used by sending node to match a returned BA message with a BU message A (acknowledge) 1-bit flag set by sending node to request a BA message be returned by receiving node upon receipt of BU message

247 H (Home Registration) 1-bit flag set by sending node to request that the receiving node act as the sending nodes HA L (Link-Local Address Compatibility) 1-bit flag set when the home address reported by mobile node has the same interface identifier as the mobile nodes link-local address

248 interface identifier a number used to identify a nodes interface on a link the remaining low-order bits in the nodes IP address after the subnet prefix link-local address an address that is only valid within the scope of a link, such as one Ethernet segment

249 K (Key Management Mobility Capability) 1-bit flag only valid in a BU message sent to a HA set by the sending node to indicate whether the protocol used for establishing the IPsec security association between a mobile and its HA can survive movement

250 Reserved reserved for future use Lifetime 16-bit unsigned integer indicates the number of time units remaining before the binding expires

251 Mobility Options a variable-length field that contains one or more Mobility Options in a Type-Length-Value format used to carry information needed for MIPv6 mobility management such as a mobiles CoA security-related information needed for a receiving node to authenticate a received message

252 examples of Mobility Options Alternative CoA option used to carry a mobiles CoA Binding Authorization Data option used to carry security-related information needed by the receiving node to authenticate and authorize BU message

253 Nonce Indices option a nonce is a random number used by a correspondent node to help authenticate a BU from a mobile this option is only used when BU message is sent to a correspondent node the correspondent node uses the information carried in this option with the information carried in the Binding Authorization Data option to authenticate a BU message from a mobile

254 Formats of Mobile IPv6 Alternative CoA Option and Binding Authorization Data Option

255 Alternative CoA Option Format Type 3, identifies an Alternative CoA option Length length in octets of the portion of this option starting immediately after the Length field 16, means exactly one CoA will be carried in the option

256 Binding Authorization Data Option Format Type 5, indicates a Binding Authorization Data option Option Length length in octets of the Authenticator field Authenticator a cryptographic value used to determine that the message comes from a right user

257 Protects the following mobility data fields Care-of Address final destination address of the packet Mobility Header Data the content of the Mobility Header excluding the Authenticator field

258 Format of Mobile IPv6 Binding Acknowledgement Message

259 Fields Status an 8-bit unsigned integer indicating the status of how the corresponding BU message is processed K indicate whether the protocol used by a HA for establishing the IPsec security association between the mobile and the HA can survive movement

260 Reserved reserved for future use Sequence Number copied from the Sequence Number field of the corresponding BU message Lifetime the time, in units of 4 seconds, for which the sender of this BA message will retain the binding of the receiving node of this BA message

261 Mobility Options a variable-length field that one or more Mobility Options in a Type-Length- Value format

262 A BA message may carry the following Mobility Options Binding Authorization Data option used to carry the security-related information for the receiving node to authenticate the BA message

263 Binding Refresh Advice option used by a HA to inform a mobile how often the mobile should send a new BU message to the HA this option is only used in a BA sent by a HA to a mobile in response to a received BU message

264 2.5.5 Hierarchical Mobile IPv6 Registration When a mobile is far away from its HA the process of binding update with HA may experience a long delay One approach to reduce binding update delay implement local HAs dynamically using the forwarding from the previous CoA

265 Mobile IPv6 Forwarding from Previous Care-of Address" Mechanisms

266 Assumptions on a mobile original home network is Subnet A original home agent, HA A, is in Subnet A mobile movement Subnet A Subnet B Subnet C Scenario while a mobile in Subnet B acquires a CoA B performs a binding update with original home agent HA A register CoA B as its primary CoA

267 When the mobile moves into Subnet C acquires a new CoA C the mobile does not have to perform address binding with home agent HA A it may send a Binding Update to home agent HA B to request HA B to serve as the HA for CoA B and use CoA C as the current care-of address for CoA B

268 packets addressed to the mobiles home address continue to be routed to mobiles home network, where they will be captured by mobiles HA HA continues to use CoA B as the primary care- of address for the mobile and tunnel intercepted packets to CoA B, i.e., to HA B HA B will extract the original packets from the tunnel and then tunnel them to the mobiles current CoA C, i.e., to the mobile itself

269 The forwarding from the previous CoA may be used to support hierarchical registration consider that the mobile subsequently moved from Subnet C to a new subnet D

270 One Approach to Support Hierarchical Mobile IPv6 Registration

271 Upon entering subnet D mobile will acquire a new CoA D mobile can choose to make HA B its local HA and register its new CoA D with this local HA only mobile uses forwarding from the previous CoA it sends a Binding Update message to HA B to use its CoA to update the CoA for its CoA B when HA B receives packets that are addressed to CoA B it will tunnel them to the mobiles CoA D

272 2.6 SIP-Based Mobility Management MIPv4 and MIPv6 IP-layer protocols Session Initiation Protocol (SIP) application-layer protocol used to support mobility over IP networks used for signaling and control of real-time voice and multimedia applications over IP networks 3GPP 3GPP2

273 SIP An application-layer protocol that can establish, modify, and terminate multimedia sessions (conferences) over the Internet a multimedia session is a set of senders and receivers and the data streams flowing from the senders to the receivers example, a session may be a telephony call between two parties or a conference call among more than two parties SIP can also be used to invite a participant to an on- going session such as a conference

274 SIP messages could contain session descriptions such that participants can negotiate with media types and other parameters of the session SIP provides its own mechanisms for reliable transmission and can run over several different transport protocols such as TCP UDP SCTP (Stream Control Transmission Protocol) SIP is compatible with both IPv4 and IPv6

275 SIP provides the following key capabilities for managing multimedia communications determine destination users current location determine whether a user is willing to participate in a session determine the capabilities of a users terminal set up a session

276 manage a session modify the parameters of a session invoke service functions to provide services to a session terminate a session

277 SIP is a client-server protocol that uses a request and response transaction model Four major components in SIP architecture SIP user agent a user agent (UA) is an Internet endpoint, such as IP phone, PC, or conference bridge, that is used to establish, modify, and terminate sessions a UA could act as both a user agent client (UAC) and user agent server (UAS)

278 a UAC is a logical entity that initiates a request a UAS, on the other hand, generates a response to a SIP request SIP redirect server a redirect server is a UAS that generates a response to redirect a request to other location

279 SIP proxy server a proxy server assumes the roles of both UAC and UAS it acts as an intermediary entity between other user agents to route SIP messages to the destination user

280 SIP registrar a registrar is a UAS that processes SIP REGISTER requests it maintains mappings from SIP user names to addresses and is the front end of the location service it is consulted by a SIP server to route messages

281 SIP in Redirect Mode

282 SIP in Proxy Mode

283 2.6.1 Movement Detection SIP application to handle mobility should detect when the mobile terminal changes its IP address (e.g., moves into a new IP network) and what the new IP address will be DHCP can help to detect network change and acquire new IP addresses mobile may ask a DHCP server for a new IP address each time the mobile detects a handoff from one radio cell to another mobile will supply its current IP address as the preferred address in its request sent to DHCP server

284 if the address assigned by the DHCP server is the same as the mobiles current IP address, the mobile is still in the same IP subnet otherwise, the mobile assumes that it has moved into a new IP network once the mobiles IP address changed, the software on the mobile should inform the SIP application of the change the SIP applications should ensure that correspondent hosts can establish SIP sessions with the mobile at its new location

285 2.6.2 Pre-session Terminal Mobility Pre-session terminal mobility the ability for correspondent hosts to establish a SIP session with a mobile regardless of where the mobile is located currently A SIP Redirect Server in a mobiles home network tracks the mobiles current location provides the location information to a caller so that the caller can contact the mobile at its new location directly to set up a SIP session

286 SIP-Based Pre-session Terminal Mobility Management

287 Scenario a correspondent user sends a SIP INVITE message to SIP redirect server in the destination users home network to establish a SIP session the SIP Redirect Server returns the destination terminals current location to the correspondent user

288 the correspondent user sends a new SIP INVITE message directly to the destination users current location to establish SIP session once the session is successfully established, user data will flow between the users directly without having to traverse the SIP redirect server

289 Key difference between SIP Redirect Server and Mobile IP HA in tracking current locations of mobiles SIP Redirect Server simply tells a caller where a destination is currently and will not be involved in relaying user traffic to the destination mobility uses Direct Delivery strategy for delivering a call to a mobile destination

290 Mobile IPv4 HA will also be responsible for relaying user packets to destination mobile Mobile IPv4 uses the Relayed Delivery strategy for delivering traffic to a mobile

291 Location Update for Supporting SIP-based Terminal Mobility

292 SIP Redirect Server learns the users current location from users SIP REGISTRATION messages whenever a user starts to use a new IP address (e.g., mobile terminal changes IP address or user uses a different terminal), it will register its new IP address with SIP Redirect Server user registration process may be performed directly with home register or via a SIP Proxy Server in visited network

293 Current location registration mobile sends a SIP REGISTRATION message carrying its current location to its home SIP Redirect Server Home SIP Redirect Server interacts with AAA servers in the home network to authenticate the user if authentication is positive Home SIP Redirect Server returns a positive acknowledgment to the mobile location update process is thus completed

294 2.6.3 Mid-Session Terminal Mobility Support Mid-session (mid-call) terminal mobility the ability to maintain an on-going SIP session, whereas the mobile terminal moves from one IP subnet to another When the mobile changes its IP address in the middle of an on-going SIP session mobile will send a new SIP INVITE message to invite correspondent host to re-establish SIP session to mobiles new location

295 Upon receiving such update information and acknowledging the mobiles SIP INVITE request the correspondent host will start to use the mobiles new IP address to address the packets destined to the mobile The mobile will update its location with its home SIP Redirect Server using location update procedure

296 SIP-Based Mid-Session Terminal Mobility Management

297 2.6.4 Limitations of IP Mobility Using SIP Limitation Limitation-1 a mobile using SIP mobility has to register its new IP address with a SIP server (e.g., a SIP Redirect Server) in the mobiles home network every time the mobile changes its IP address this could introduce long handoff delays when the mobile is far away from its home network this could also create a high load on home server

298 Resolution hierarchical registration is used to reduce the registration latency

299 ‚Limitation-2 it is difficult for SIP-based mobility management to keep a TCP session alive while a mobile changes its IP address changing the IP address on either end of a TCP session will cause the TCP session to break with SIP-based terminal mobility, when a mobile changes its IP address, a correspondent host will have to address its outgoing packets to the mobiles new IP address

300 Resolution a mobile terminal and a correspondent host uses a software agent called a SIP EYE agent to hide the IP address change from the on-going TCP sessions

301 A SIP EYE agent on a terminal operates as follows it maintains a list of the on-going TCP connections on the terminal it detects the birth and death of TCP connections by examining the headers of TCP packets

302 for each on-going TCP session, the SIP EYE agent records the following information original IP address of the terminal served as a terminals source IP address when the TCP session was initiated current IP address of the terminal used to receive IP packets from the visited network

303 original IP address of the correspondent host for this TCP session served as correspondent hosts source IP address when the TCP session was initiated

304 when the mobile terminal changes its IP address it will send a SIP INFO message to the correspondent host of each on-going TCP session to inform them of the mobiles new IP address the TCP application on the mobile does not need to know that the mobile has changed its IP address continues to use its original IP address as the source IP address in all outgoing TCP packets

305 The SIP EYE agent on a correspondent host operates as follows being notified that the mobile has changed its IP address encapsulate each outgoing TCP packet with a new IP header that carries the mobiles new IP address as the destination address these packets will be routed via regular IP routing to the mobile terminals new location

306 the TCP application on the correspondent host does not need to be aware that the mobile has changed its IP address continues to address its outgoing packets to the mobiles original IP address

307 The SIP EYE agent on the mobile terminal operates as follows receive such an encapsulating packet strip off the encapsulating header added by the correspondent host deliver the payload TCP packet to the TCP process

308 TCP application continue to use the original source and destination IP addresses throughout the on-going TCP session without any modification to the TCP protocol allows TCP session to remain alive when the mobile changes its IP address

309 SIP EYE approach has a potentially significant limitation it requires a SIP EYE agent to be implemented on every mobile and every correspondent host its difficult over a large network such as Internet

310 2.7 Cellular IP With Mobile IP when a mobile is far away from its HA and wants to register new IP address with its HA this could lead to long handoff delay Cellular IP designed to support fast handoff in a wireless network of limited size (e.g. a network within the same administrative domain) mobile doesnt need to change its IP address while moving inside a Cellular IP network, and thus reducing handoff latency

311 Main reason for a mobile to change its IP address when moving into a new IP subnet regular IP routing uses prefix-based routing which divides network into subnets and requires different subnets to use disjoint IP address spaces Cellular IP a mobile doesnt need to change its IP address inside a cellular network does not use prefix-based routing

312 uses host-specific routing network nodes perform routing and packet forwarding based on the full IP address of each mobile network maintains a host-specific downlink route to forward packets to each mobile, rather than maintaining a route for each IP address prefix

313 Cellular IP

314 Two types of network nodes in Cellular IP network Base Stations (BS) internal to a Cellular IP network and do not interface directly with external networks can be a wireless access point that provides air interface to mobiles or a router that does not have any air interface Gateway Router interconnects a Cellular IP network with external IP networks

315 Nodes use Cellular IP routing protocol to determine routes from one node to another host-specific downlink route to each mobile

316 2.7.1 Cellular IP Routing Uplink packets packets originated from mobiles inside Cellular IP network first routed hop-by-hop to gateway router gateway router determines where to route the packet and then forward the packet toward destination periodically broadcasts a beacon packet throughout Cellular IP network

317 BS records the interface on which the beacon packet is received uses reverse path to forward uplink packets to router

318 Downlink packets packets sent over a host-specific downlink route from gateway router to a mobile inside Cellular IP network host-specific downlink routes are established and maintained by Cellular IP routing each network node maintains a routing cache an entry in a routing cache is called a routing entry

319 a routing entry points to the next-hop network node along host-specific route the host-specific downlink route to a mobile is established when any packet is forwarded from mobile toward gateway router as a packet from a mobile is forwarded toward gateway router, each network node along the path packet will create a routing entry that points to BS from which the packet is received

320 Network nodes maintain routes in soft states routes will be removed if no route-update packet is received during a predetermined time period when a mobile does not have any user packet to transmit, it may send small special route-update packets toward gateway to refresh route entries

321 Cellular IP integrates location management with routing each time a mobile sends a route-update packet or any other packet the downlink host-specific route for the mobile will also be updated mobiles location is implicitly maintained by up- to-date host-specific downlink route to the mobile

322 The way Cellular IP BSs learn the routes to the gateway router and to each mobile suggests that the physical configuration of a Cellular IP network has to be loop free, i.e., a tree or a string otherwise, routing loops may occur

323 example if there is a physical connection between BSs 3 and 4; i.e., BSs 1, 3, and 4 form a loop when gateway router broadcasts beacon packets, BSs 3 and 4 will receive beacon from each other BS 3 will take BS 4 as the next hop to forward uplink packet, and BS 4 will take BS 3 as the next hop to forward uplink packet forms a routing loop

324 2.7.2 Handoffs Inside a Cellular IP Network Cellular IP supports two types of handoffs hard handoff semi-soft handoff

325 Hard Handoff Implemented using Break-before-Make strategy When a mobile moves from old BS to new BS, it tunes its radio to new BS The packets on the way to old BS may be lost Mobile then sends a route-update packet toward gateway router

326 Route-update packet triggers the nodes along its path to setup a host-specific downlink route for mobile the route-update packet will eventually reach a cross-over node cross-over node is a node shared by mobile's old downlink host-specific route that goes to old BS mobile's new downlink host-specific route set up by current route-update packet

327 examples if mobile moves from BS 3 to BS 4, the cross- over node will be BS 1 if mobile moves from BS 5 to BS 6, the cross- over node will be BS 2

328 When route-update packet reaches a cross-over node this node will update mobile's downlink host- specific route and start to forward future packets to mobile's new BS packets that have already been on their way to old BS may be lost

329 Semi-Soft Handoff Allows a mobile to receive packets from old BS before network sets up its route to new BS Mobile tunes its radio to new BS sends a semi-soft handoff packet via new BS toward gateway tunes its radio back to old BS immediately to continue receiving packets from old BS while network is setting up mobile's downlink host- specific route to new BS

330 Semi-soft handoff packet triggers nodes on its path to set up a downlink host- specific route to new BS for the mobile when this packet reaches the first cross-over node, this node will start forwarding packets to both old and new BSs After a predetermined amount of delay (expected downlink host-specific route setup time) mobile disconnects from old BS and tunes its radio to new BS to receive packets from new BS only

331 2.7.3 Handoff between Cellular IP Networks or between Cellular IP and Regular IP Networks Handled by a macromobility management protocol (e.g., Mobile IP) Mobile inside a Cellular IP network uses the IP address of gateway router as its Mobile IP CoA uses its Mobile IP home address to send and receive packets over Cellular IP network

332 Upon entering a new Cellular IP network mobile sends a route-update packet toward gateway router to trigger new Cellular IP network to set up a downlink host-specific route for the mobile Gateway router acts as a Mobile IP FA sends Mobile IP Agent Advertisement messages to mobile after it receives the first packet from mobile

333 mobile learns the IP address of gateway router from Advertisement uses this address as its new CoA registers this address with its HA

334 After a successful Mobile IP registration packets addressed to mobile's home address will be tunneled by mobile's HA to mobile's current CoA (the IP address of gateway router) Gateway router will de-tunnel packets and forward the payload packets along the downlink host- specific route to mobile directly without encapsulation or tunneling

335 2.7.4 Paging Dormant (idle) mobile a mobile that has not transmitted packets for a predefined time period (active-state-timeout) For a mobile that has not sent packets over active-state- timeout its host-specific route will be removed by network When a gateway router has packets to send to a mobile if the router does not have a valid routing entry for mobile (i.e., mobile is dormant), it will initiate paging to locate mobile first

336 To support paging Cellular IP organizes BSs into paging areas when a dormant mobile crosses a paging area boundary, it updates its location with the network by sending a paging-update packet to gateway router this packet is addressed to gateway router and forwarded by BSs hop-by-hop to the router

337 A network node may optionally use a paging cache to maintain paging routes for dormant mobiles paging entry in the cache points to the next-hop network node along the paging route to a specific dormant mobile paging update packet trigger the network nodes, which have paging caches, to create a new paging entry or update its existing paging entry

338 Paging in Cellular IP Networks

339 When a node receives a downlink packet to send to a mobile but does not have a valid routing entry the node will check if it has a valid paging entry for the mobile if it does, it will forward a paging message along the paging route toward mobile otherwise, it will broadcast a paging message over all its interfaces except the one that receives packets

340 When a paging message reaches the first BS in the dormant mobile's current paging area this message will be broadcast over the paging area to all BSs and, hence, to all mobiles inside the paging area

341 Upon receiving a paging message or any other packet, a dormant mobile will transit into active mode start to send route-update packets toward gateway router trigger network to set up and maintain a host- specific downlink route for the mobile

342 The paging entries are maintained as soft states a dormant mobile may refresh its paging route by periodically sending paging-update packets to gateway router

343 Paging-update packets cannot be used to update routing caches as a result, a network node may maintain only a paging entry for a dormant mobile, but it does not need to maintain any routing entry for the mobile this reduces the sizes of the routing caches because a large percentage of the mobiles may be dormant at any given time in a real wireless network

344 When a BS wants to send a packet to an active mobile it only needs to search the routing cache, which reduces the delay incurred by table lookups at the BSs

345 2.8 HAWAII Handoff-Aware Wireless Access Internet Infrastructure HAWAII and Cellular IP are similar in many ways both designed to support fast handoff and paging inside a wireless network under a single administrative domain use similar techniques use host-specific routes to deliver packets to mobile reduce handoff latency by reducing the frequency of changing IP addresses

346 HAWAII and Cellular IP are different in routing and mobility management implementations HAWAII organizes a network into domains a HAWAII domain is a network under the control of one administrative entity and uses HAWAII internally

347 A HAWAII domain consists of three types of network nodes Base Stations (BSs) Routers Domain Root Routers (DRRs)

348 HAWAII

349 Base Station a network node that supports air interface or other radio specific functions Router used to interconnect BSs Domain Root Router (DRR) used to interconnect a HAWAII domain to external IP networks (e.g., the Internet)

350 Mobile has a home domain (belongs to mobile's service provider) has an IP address could be statically configured when subscribes to network services may also dynamically assigned by DHCP

351 while moving inside the same HAWAII domain does not need to change IP address upon entering a new domain has to obtain a new IP address from new domain

352 All IP packets originated from or destined to any mobile inside a HAWAII domain will be routed first to DRR in HAWAII domain DRR then forwards these packets to destinations DRR uses regular IP routing to route packets destined to external IP networks DDR uses a host-specific forwarding route established by HAWAII Path Setup Schemes to forward packets destined to a mobile inside HAWAII domain

353 Network nodes maintain host-specific forwarding routes in soft states a network node needs to maintain state information about a host-specific route only if it is part of that route this reduces state information each router needs to maintain and thus improves network scalability

354 HAWAII uses regular IP routing protocol to route and forward packets example IP packets addressed to any HAWAII network node or to external IP networks will be routed by regular IP routing protocol the physical configuration of each HAWAII domain can be of any topology as IP routing creates loop-free routes

355 2.8.1 Mobile Powers Up in its Home HAWAII Domain When a mobile powers up in its home HAWAII domain it may need to acquire an IP address from its home domain if it does not already have one home HAWAII domain needs to establish a host- specific forwarding route from DRR to mobile for packets delivering

356 HAWAII Mobile Power-up Procedure

357 Power-Up Procedure Step1 mobile powers up in home HAWAII domain mobile sends a MIPv4 Registration Request (Message 1) to its current BS A BS A creates a host-specific forwarding entry for mobile indicating that the mobile is reachable over its air interface

358 Mobile IP may be used to support handoff between HAWAII domains mobile's Mobile IP HA may be located inside mobile's home HAWAII domain mobile's IP address obtained from home HAWAII domain can be mobile's Mobile IP home address Mobile IP Registration Request is used only for triggering HAWAII path setup procedure

359 Step 2 BS A looks up its regular IP forwarding table to find the next-hop node (Router 1) toward DRR BS A sends a HAWAII power-up message (Message 2) to Router 1 this message triggers Router 1 to create a host- specific forwarding entry points to BS A

360 Step 3 Router 1 sends a HAWAII message (Message 3) to its next-hop node (DRR) toward DRR Message 3 triggers DRR to create a host-specific forwarding entry points to Router 1 Step 4 DRR sends an ack (Message 4) back to BS A Step 5 BS A sends a MIP Registration Reply to mobile

361 From this point on DRR will use host-specific forwarding route created during powering up procedure to forward user IP packets to mobile Network nodes maintain host-specific routes in soft states mobile has to refresh its host-specific route by sending HAWAII path refresh messages to DRR periodically

362 2.8.2 Handoffs Inside a HAWAII Domain HAWAII provides two basic path setup schemes to support handoff Forwarding Path Setup Scheme Non-Forwarding Path Setup Scheme

363 HAWAII Forwarding Path Setup Schemes

364 Forwarding Path Setup Scheme Allows old BS to forward user packets to new BS (which in turn forwards packets to mobile) A host-specific route will be established from old BS to new BS

365 Procedure [Step1] when a mobile connects to a new BS B, it sends a MIPv4 Registration Request message (Message 1) to new BS this message will inform new BS that the mobile's previous BS was BS A

366 [Step 2] BS B initiates a HAWAII Handoff Message (Message 2) and sends it to BS A along the route created by regular IP routing BS A uses the IP address of BS B and the forwarding table generated by regular IP routing to determine Router 1 as the next-hop router for forwarding packets to BS B

367 BS A then sets up a host-specific forwarding entry for mobile this will allow BS A to forward future packets destined to mobile to Router 1

368 [Step 3] BS A sends a HAWAII message (Message 3) to Router 1 to trigger Router 1 to set up a host-specific forwarding entry for mobile [Step 4] Router 1 uses the IP address of BS B and the forwarding table generated by regular IP routing to determine the next-hop router (Router 2) for forwarding packets to BS B

369 Router 1 will establish a host-specific forwarding entry for mobile and set the next-hop for the host- specific route to Router 2 from now on, Router 1 will forward packets destined to mobile to Router 2 Router 1 will also send HAWAII message 4 to Router 2 to trigger Router 2 to create a host-specific forwarding entry for mobile

370 [Step 5] Router 2 is the cross-over router Router 2 will start to forward future packets destined to mobile along the new host-specific route to new BS B directly, and then to mobile

371 [Step 6] Router 2 sends a HAWAII message to the next-hop router (Router 3) along the route toward BS B the process continues until a host-specific route is established from BS A to BS B for the mobile [Step 7] BS B sends a MIP Registration Reply message to mobile, completing the path setup process

372 Nonforwarding Path Setup Scheme Packets may not be forwarded from old BS to new BS When packets destined to mobile arrive at a cross-over router packets will be forwarded by cross-over router to new BS, and then to mobile a cross-over router is a router shared by host-specific forwarding route from DRR via old BS to mobile host-specific forwarding route from DRR via new BS to mobile

373 HAWAII defined multiple forms of Nonforwarding Path Setup Schemes Here we focus on Unicast Nonforwarding Scheme

374 HAWAII Unicast Non-Forwarding Path Setup Schemes

375 Procedure [Step 1] when a mobile moves to BS B, it sends a MIPv4 Registration Request message to BS B to initiate handoff procedure this message will carry the IP address of the old base station BS A

376 [Step 2] BS B creates a host-specific forwarding entry for mobile with outgoing interface set to the interface on which it received Registration Request BS B uses the IP address of BS A and looks up the IP forwarding table established by regular IP routing to determine the next-hop router (Router 3) toward BS A BS B then sends HAWAII Message 2 to Router 3

377 [Step 3] Router 3 creates a host-specific forwarding entry for mobile with the next-hop node set to BS B Router 3 then determines the next hop toward BS A is Router 2 and forwards HAWAII Message 3 to Router 2

378 [Step 4] Router 2 creates a host-specific forwarding entry for mobile with outgoing interface set to Router 3 Router 2 is the cross-over router after Router 2 creates the new host-specific forwarding entry for mobile, it will forward future user packets destined to mobile to BS B directly Router 2 also sends a HAWAII message (Message 4) to the next-hop router (Router 1) toward BS A

379 [Step 5] this process continues until BS A receives a HAWAII message (Message 5)

380 [Step 6] BS A establishes a host-specific forwarding entry for mobile and then sends an ack message (Message 6) back to BS B this message will trigger BS B to send a MIPv4 Registration Reply message back to mobile to complete path setup and handoff procedure

381 2.8.3 Moving into Foreign HAWAII Domains A macromobilitymanagement protocol such as Mobile IP can be used to support handoff between HAWAII domains ensure that a mobile is always addressable by a permanent home address when it moves into foreign HAWAII domains

382 Handoff between HAWAII Domains Using Mobile IP

383 Interdomain Handoff Procedure using Mobile IP When a mobile enters a new HAWAII domain it first needs to obtain a new IP address from new HAWAII domain this may be achieved using, e.g., DHCP After the mobile acquires a new IP address the new HAWAII domain needs to set up the initial host-specific forwarding route from DRR to mobile this is achieved using power-up procedure

384 When mobile's current BS receives ack message (Message 4) from DRR indicating that a host-specific forwarding route has been set up from DRR to mobile the BS will forward mobile's Mobile IP Registration Request message to mobile's Mobile IP home agent

385 The mobile uses the IP address it obtained from new HAWAII domain as its co-located CoA packets addressed to mobile's home address will be tunneled by mobile's HA to mobile directly these packets will enter mobile's current HAWAII domain via a DRR in the domain DRR will forward packets along the host-specific forwarding route to mobile mobile will then de-tunnel packets to extract original packets

386 2.8.4 Paging HAWAII groups BSs into paging areas Each paging area is identified by an IP Multicast Group Address (MGA) that has a scope of the administrative domain

387 While a mobile is in dormant mode (or standby mode) network will only know mobiles currently located paging area but not the currently connected BS a dormant mobile will send a location update message toward DRR every time it crosses a paging area boundary location update message is propagated hop-by-hop from mobile's current BS to DRR it triggers BS and each router along its path to create a new or update its existing host-specific routing entry and paging entry for mobile

388 a routing entry is for forwarding regular user packets to a mobile a paging entry is for forwarding paging messages to a mobile routing entries and paging entries on a network node are maintained separately

389 Paging entry contains the following main information the MGA (Multicast Group Address) that identifies mobile's current paging area the outgoing interface for sending paging messages to mobile

390 To page a mobile a network node (router or BS) acts as a Paging Initiator a paging initiator is responsible for creating a paging message and multicasting it to the MGA (all the BSs) of paging area each BS will in turn send a paging message to all the mobiles it is serving buffering packets destined to a dormant mobile while the mobile is being paged

391 To increase network reliability and scalability paging in a HAWAII domain does not use a centralized paging initiator for all mobiles paging initiator functionality is dynamically distributed to network nodes a network node may dynamically elect itself as a mobile's paging initiator

392 before a network node can initiate paging for a mobile (ensuring paging initiator knows mobiles latest paging area) only a node along mobile's latest host-specific paging route (established by mobile's latest location update) can be paging initiator for mobile

393 a paging initiator initiates paging only when it receives packets destined to mobile from an upstream node node A is node B's upstream node when both nodes are on the latest paging route from DRR to mobile's last-known BS, but node A is closer to DRR

394 Packets originated inside a dormant mobile's current HAWAII domain have to be routed first to DRR DRR will forward packets along mobile's latest paging route toward mobile's current paging area Upon receiving a packet from the DRR a router or BS on mobile's latest paging route may then elect itself as mobile's paging initiator and initiates a paging message

395 3. Mobility Management in 3GPP Paket Networks Assumptions mobility management in packet-switched (PS) domain of a 3GPP network (Release 5) RAN is assumed to be UTRAN

396 3GPP Conceptual Network Architecture (Release 5)

397 3GPP Network Architecture and Protocol Reference Model (Release 5)

398 Components Public Land Mobile Network (PLMN) a public network administrated by a single network operator for providing land mobile services 3GPP PLMN consists of one or more Radio Access Networks (RANs) interconnected via a Core Network (CN) RAN provides radio resources (e.g., radio channels, bandwidth) for users to access CN Release 5 currently supports GSM/EDGE RAN (GERAN) and UMTS Terrestrial RAN (UTRAN)

399 GERAN divided into Base Station Subsystems (BSS) BSS consists of one or multiple Base Transceiver Stations (BTSs) and Base Station Controllers (BSCs)

400 BSC controls radio connections toward mobile terminals as well as wireline connections toward CN each BSC can control one or more BTSs BTS maintains air interface handles signaling and speech processing over air interface

401 UTRAN divided into Radio Network Subsystems (RNS) RNS consists of one or multiple Node Bs controlled by a Radio Network Controller (RNC)

402 RNC analogous to a BSC in GSM controls radio connections toward mobile terminals and wireline interfaces with CN Node B a wireless base station analogous to a BTS in GSM provides air interface with mobile terminals

403 Core Network CN support both circuit-switched (CS) and packet- switched (PS) communication services communication services include basic services and advanced services basic CS services switching of CS voice and data calls and call control functions for supporting basic point- to-point CS calls basic PS services routing and transport of user IP packets

404 advanced CS services prepaid calls, toll-free calls, call forwarding (e.g., forward a voice phone call to another phone or to an box), multiparty communications, and pay-per-view advanced PS services , World-Wide Web, location-based services, multimedia messaging services, network gaming, and e-commerce

405 CN is divided into the following functional building blocks circuit-switched domain packet-switched domain IP Multimedia Subsystem (IMS) provides all the network entities and procedures to support real-time voice and multimedia IP applications uses SIP to support signaling and session control for real-time services

406 Information Servers maintain necessary information for network operations and provide services to users these information servers are as follows Home Subscriber Server (HSS) the connecting element between PS and IMS domains Authentication Center (AuC) Equipment Identity Register (EIR)

407 In CN, old CS switch, MSC, has been divided into two logical entities MSC server control logic is in MSC Media gateway (CS-MGW) actual switching matrix in MGW data typically bypasses the control logic in CN

408 Protocol Reference Model for 3GPP PS Domain

409 Packet Data Protocols, Bearers, and Connections for Packet Services A mobile uses a Packet Data Protocol (PDP) to exchange user packets over a 3GPP PS CN domain with other mobiles either inside the same 3GPP network or in other IP networks PDP Packet Data Units (PDUs) (i.e. user packets) transported inside a 3GPP network over traffic bearers

410 Traffic bearer a set of network resources and data transport functions used to deliver user traffic between two network entities can be a path, a logical connection, or a physical connection between two network nodes

411 3GPP Bearers for Supporting Packet- Switched Services

412 Traffic Bearers Structure Supporting Packet-Switched Services 3GPP Bearer a dedicated path between mobile and its serving GGSN for a mobile to send or receive packets over a 3GPP PS CN a 3GPP Bearer in a UMTS network would be a UMTS Bearer

413 constructed by concatenating Radio Access Bearer (RAB) connects a mobile over a RAN to the edge of CN (i.e., a SGSN) CN Bearer carries user traffic between the edge of CN and a GGSN

414 Signaling and Traffic Connections between Mobile and SGSN

415 The signaling connection between mobile and SGSN is constructed by concatenating Signaling Radio Bearer between mobile and RAN (e.g., the RNC in UTRAN) I u Signaling Bearer between RAN and SGSN

416 Signaling and traffic connections between mobile and SGSN Radio Resource Control (RRC) connection Radio Access Network Application Part (RANAP) connection

417 Radio Resource Control (RRC) connection includes Signaling Radio Bearers and Traffic Radio Bearers for the same mobile used to establish, maintain, and release Radio Bearers a mobile will use a common RRC connection to carry signaling and user traffic for both PS and CS services

418 Radio Access Network Application Part (RANAP) connection includes I u Signaling Bearers and I u Traffic Bearers for the same mobile used to establish, maintain, modify, change, and release all these I u Bearers

419 Packet Routing in 3GPP PS Domain

420 Mobility Management in 3GPP Packet Networks All PS user data to and from a mobile is first sent to a GGSN called mobile's serving GGSN serving GGSN will in turn forward user data toward their destinations mobile and its serving GGSN use a host-specific route to exchange user data mobility management in 3GPP PS domain is to manage the changes of host-specific route between each mobile and its serving GGSN

421 Host-specific route consists of a RRC connection between mobile and RAN a RANAP connection between RAN and SGSN CN Bearers between SGSN and mobile's serving GGSN Mobile's Serving RNC the RNC that receives data from PS CN domain and then distributes data to mobile

422 For a mobile to exchange signaling messages with PS CN (e.g., to set up and manage traffic bearers, to perform location update) a dedicated logical signaling connection (Signaling Radio Bearer and I u Signaling Bearer) needs to be established between mobile and SGSN

423 Mobile does not need to maintain all traffic bearers in RAN or CN if it does not expect to send or receive user data soon does not even need to maintain its dedicated signaling connection to SGSN at all times may release radio resources for other mobiles to use

424 Scope of Mobility in 3GPP Packet-Switched Domain Scope of mobility Inter-Node B handoff Inter-RNC handoff Inter-SGSN handoff Inter-GGSN handoff

425

426 Inter-Node B Handoff change mobile's Radio Bearers from source Node B to target Node B Inter-RNC Handoff change mobiles Radio Bearers change mobile's I u Bearers

427 Inter-SGSN Handoff change Radio Bearers change I u Bearers update mobile's PDP context establish a new CN Bearer

428 Inter-GGSN Handoff change Radio Bearers change I u Bearers mobile's new serving GGSN creates a PDP context for mobile establish a CN Bearer between mobile's new serving GGSN and new serving SGSN

429 3.1 Packet Mobility Management (PMM) Context and States Mobiles PMM context a set of information used by network to track mobiles location State of a mobiles PMM context determines which network connections (bearers) between mobile and SGSN should be maintained for mobile how mobiles location should be tracked by network

430 3GPP PS domain Mobile needs to maintain a PMM context to collaborate with network for location tracking SGSN responsible for tracking locations of mobiles that are using PS services needs to maintain PMM contexts of mobiles

431 GGSN not directly involved in location tracking does not need to know any mobiles PMM context or PMM state

432 A PMM context on mobile or SGSN can be in one of the following states (for UMTS) PMM-DETACHED State PMM-CONNECTED State PMM-IDLE State

433 PMM-DETACHED State No communication between mobile and SGSN Mobile and SGSN do not have valid location or routing information for mobile Mobile does not react to system information related to SGSN SGSN cannot reach mobile

434 PMM-CONNECTED State SGSN and mobile have established a PMM context for mobile a dedicated signaling connection between mobile and SGSN Signaling connection consists of RRC connection between mobile and RAN I u signaling connection over I u interface between RAN and SGSN

435 PS domain-related signaling and CS domain-related signaling share one common RRC connection one I uCS signaling connection for CS domain one I uPS signaling connection for PS domain

436 PMM-IDLE State SGSN and mobile have established PMM contexts for mobile No signaling or traffic connection exists between mobile and SGSN A mobile moves into PMM-IDLE state to conserve scarce resources, e.g., power off the mobile, reduce transmissions of signaling messages to conserve radio bandwidth

437 3GPP PMM State Transition Machines

438 PMM-DETACHED State to PMM-CONNECTED State When mobile performs GPRS Attach to attach to PS domain GPRS Attach procedure a signaling connection needs to be established between mobile and its serving SGSN

439 PMM-CONNECTED State to PMM-IDLE State Whenever the signaling connection between mobile and its serving SGSN is released Example when GPRS Attach process is finished, this signaling connection may be released immediately, which will cause mobiles PMM state to change from PMM-CONNECTED to PMM-IDLE

440 PMM-IDLE State to PMM-CONNECTED State A mobile in PMM-IDLE state may need to establish a signaling connection to SGSN for various purposes example a mobile needs to establish a signaling connection to SGSN to perform routing area update when this signaling connection is not needed in near future (e.g., after routing area update is completed), it may be released to allow mobiles PMM state to change back to PMM-IDLE

441 PMM-CONNECTED State to PMM-DETACHED State When GPRS Detach procedure is performed When mobiles GPRS Attach request is rejected by SGSN When mobiles Routing Area Update (RAU) request is rejected by SGSN

442 PMM-IDLE State to PMM-DETACHED State A mobile or a SGSN may change from PMM-IDLE to PMM-DETACHED as a result of a local event Example state change on a mobile when SIM, USIM, or battery is removed from mobile state change on SGSN when the lifetime of PMM state expires

443 Discussions PMM context cannot change from PMM-DETACHED to PMM-IDLE directly before a mobiles PMM context can be in PMM- IDLE state, mobiles PMM context has to be created first on SGSN to create a PDP context on SGSN, mobile has to perform GPRS Attach this will cause mobiles PMM state to change from PMM-DETACHED to PMM CONNECTED first, before it transits into PMM-IDLE

444 3.2 Location Management for Packet- Switched Services

445 3.2.1 Location Concepts RANs and CN in 3GPP network use different location concepts to track mobiles locations RAN uses the following location concepts Cell Area (or Cell) the geographical area served by one wireless BS UTRAN Registration Area (URA) covered by a set of cells

446 CN uses the following location concepts Location Area (LA) a group of Cells used by CS CN domain to track the locations of mobiles that are using CS services Routing Area (RA) a group of Cells used by PS CN domain to track the locations of mobiles that are using PS services

447 3GPP Location Management for Packet Services

448 LA consists of one or more Cells that belong to the RNCs that are connected to the same MSC/VLR all Cells in the same URA have to be served by the same MSC/VLR one LA is handled by only one MSC/VLR each LA is identified by a globally unique Location Area Identifier (LAI)

449 when a mobile moves inside an LA, it does not have to perform location update with CN CS domain

450 RA consists of one or more Cells that belong to the RNCs that are connected to the same SGSN one RA is handled by only one SGSN an RA is either the same as an LA or a subset of one and only one LA one RA cannot belong to more than one LA, whereas each LA may contain multiple RAs each RA is identified by a globally unique Routing Area Identifier (RAI)

451 Structures of 3GPP Location Area Identifier and Routing Area Identifier

452 LAI Mobile Country Code (MCC) identifies the country in which the 3GPP network is located Mobile Network Code (MNC) identifies a 3GPP network in that country Location Area Code (LAC) identifies a Location Area within a 3GPP network

453 RAI Location Area Identifier (LAI) contains an LAI that identifies the Location Area in which the RA resides Routing Area Code (RAC) identifies a Routing Area inside the LA identified by the LAI

454 3.2.2 Location Tracking 3GPP uses hierarchical location tracking the methods and accuracy level of location tracking for each mobile depend on activeness level of mobile a mobiles activeness level is represented by the mode of its RRC connection

455 A mobiles RRC connection has two modes RRC-CONNECTED mode a mobile has an established RRC connection mobile may be either in PMM-CONNECTED or PMM-IDLE state because a mobile uses a single RRC connection for both CS and PS services mobile can be in RRC-CONNECTED mode and PMM-IDLE state at the same time because the RRC connection may be present but is currently used only for CS services; i.e., no signaling connection is established to SGSN

456 RRC-IDLE mode a mobile has not established any RRC connection mobiles PMM state can only be PMM-IDLE or PMM-DETACHED because no signaling connection between mobile and SGSN can exist without an RRC connection

457 Location Tracking Depends on Mobiles RRC Connection Mode When a mobile is in the RRC-IDLE mode (hence, also in PMM-IDLE state) mobiles location is tracked at the RA level by SGSNs mobile in RRC-IDLE mode will receive Mobility Management (MM) system information broadcast by RNCs at RRC layer MM system information informs mobile which RA and Cell it is in currently

458 mobile will initiate RA Update toward CN upon receiving MM system information, indicating that it moved into a new RA

459 When a mobile is in RRC-CONNECTED mode mobiles location inside RAN is tracked at cell level by RNCs an RNC identifies a mobile by a temporary identifier, the Radio Network Temporary Identity (RNTI), to track mobiles RNTI is assigned to mobile dynamically by an RNC

460 mobile receives MM system information from serving RNC over the established RRC connection it uses MM system information to determine if it has moved into a new Cell, RA, or LA

461 When a mobile is in RRC-CONNECTED mode and PMM-IDLE state SGSNs will also track the mobiles location at RA level mobile will initiate RA Update toward CN PS domain upon receiving MM system information, indicating that it has just moved into a new RA

462 When a mobile is in RRC-CONNECTED mode and PMM-CONNECTED state mobiles serving SGSN will know the mobiles serving RNC because the serving SGSN maintains a signaling connection through mobiles serving RNC to mobile

463 when mobiles serving RNC function needs to be changed to a new RNC as mobile moves mobiles serving SGSN will participate in this change process (i.e., Serving RNS Relocation procedure) to ensure that signaling connection between mobile and SGSN will go through new serving RNC

464 Serving RNS Relocation Procedure the process for relocating RNC side of endpoint of an I u bearer from one RNC to another

465 3.3 Routing Area Update Routing area update in 3GPP allows mobiles serving SGSN to know which RA the mobile is currently in mobiles existing active PDP contexts to be updated

466 example if moving into a new RA also means that the mobile has to use a new SGSN a PDP context between new SGSN and mobiles serving GGSN needs to be established this ensures that the mobiles serving GGSN always knows where to forward user packets destined to mobile

467 A mobile performs RA update when mobile enters a new RA mobiles periodic routing area update timer expires

468 Types of RA update Intra-SGSN RA update occurs when new RA and old RA connect to the same SGSN Inter-SGSN RA update occurs when new RA and old RA connect to different SGSNs

469 3.3.1 Intra-SGSN Routing Area Update To send uplink signaling messages to perform an RA update the mobile first establishes a RRC connection with target RNC if such a channel does not exist the mobile has to be in PMM-CONNECTED state for at least the duration of RA Update procedure

470 if the mobile is in PMM-IDLE state before it starts RA Update establish necessary signaling connection to target SGSN change mobiles PMM state into PMM- CONNECTED

471 Routing Area Update Request (RAUR) carries the following main information P-TMSI (Packet-Temporary Mobile Subscriber Identity) the information that mobile has been using immediately before sending RAUR message mobiles P-TMSI is assigned by its source SGSN

472 Old RAI used by target SGSN to determine whether it is an intra-SGSN or inter-SGSN RA Update Old P-TMSI Signature P-TMSI signature is used by SGSN to authenticate P-TMSI Old P-TMSI Signature is the current P-TMSI signature the mobile has for its current P-TMSI

473 Update Type tells target SGSN whether RA Update is triggered by a change of RA, a periodic RA update, or a combined RA/LA update Network Capability a set of information describing mobile's non- radio-related capability it includes, for example, information needed for performing ciphering and authentication

474 Footnote IMSI (International Mobile Subscriber Identity) each subscriber to 3GPP network services is assigned a globally unique IMSI as its permanent identifier a subscriber uses its IMSI as its common identifier for accessing PS services, CS services, or both PS and CS services at the same time

475 TMSI (Temporary Mobile Subscriber Identity) to avoid transmitting IMSI over the air, 3GPP uses TMSI to identify a mobile whenever possible TMSI is a four-octet number assigned to a mobile temporarily by an MSC/VLR for CS services, or by an SGSN for PS services an MSC or SGSN uses a TMSI to uniquely identify a mobile TMSI will only be allocated in ciphered form

476 P-TMSI (Packet TMSI) a TMSI for packet-switched services

477 3GPP Intra-SGSN Routing Area Update Procedure

478 [Step 1] Mobile initiates RA update by sending a RAUR to target RNC RAUR is then forwarded to target SGSN this will trigger the establishment of an I u signaling connection between them if such a connection does not exist (e.g., if mobile was in PMM-IDLE state before sending RAUR)

479 target SGSN determines whether RA update is intra-SGSN or inter-SGSN RA update by examining Old RAI carried in RAUR RA update is intra-SGSN RA update if target SGSN also serves old RA

480 [Step 2] Target SGSN needs to authenticate mobile to determine whether RAUR can be accepted as mobile identifies itself by its P-TMSI in RAUR, target SGSN will authenticate mobile by validating mobiles P-TMSI first only the SGSN that assigned P-TMSI has sufficient information (i.e., mobiles IMSI and correct P- TMSI Signature for P-TMSI) to validate P-TMSI

481 as target SGSN is identical to source (serving) SGSN with an intra-SGSN handoff target SGSN should be the SGSN that assigned old P-TMSI to mobile and therefore should be able to validate P-TMSI locally

482 [Step 3 & 4] Upon positive authentication of mobile, SGSN updates mobiles RAI if mobile was in PMM-CONNECTED state on target SGSN some user traffic destined to mobile may have been sent by target SGSN to source RNC and are buffered at source RNC as mobile is now connected to target RNC source RNC can not deliver these buffered traffic over its radio connections to mobile

483 if these traffic belong to a Radio Access Bearer that requires in-order delivery packets target SGSN may send a Serving RNS (SRNS) Data Forward Command to instruct source RNC to tunnel the buffered traffic to target SGSN target SGSN will in turn deliver this traffic to mobile before sending subsequent traffic

484 [Step 5] SGSN will also send a Routing Area Update Accept (RAUA) message to mobile to inform that its RAUR is accepted target SGSN may assign a new P-TMSI to mobile the new P-TMSI together with a P-TMSI Signature for new P-TMSI will be carried in RAUA message

485 [Step 6] Mobile confirms the acceptance of new P- TMSI by returning a Routing Area Update Complete (RAUC) message to SGSN, which completes RA Update procedure

486 3.3.2 Inter-SGSN Routing Area Update [Step 1] Mobile initiates an inter-SGSN RA update by sending a RAUR to target SGSN in exactly the same format and information elements as in initiating an intra-SGSN RA update target SGSN needs to authenticate mobile to determine if the RAUR can be accepted

487 3GPP Inter-SGSN Routing Area Update Procedure (1) (2)(3) (4) (5) (6) (7) (8) (9)(10) (11) (12) (13) (14)(15) (16) (17) (18) (19) (20) (21) (22)

488 for an inter-SGSN RA update target SGSN is different from source SGSN mobiles P-TMSI in RAUR was assigned by source SGSN target SGSN will ask source SGSN to help validate P-TMSI target SGSN first derives source SGSN from Old RAI and P-TMSI carried in RAUR

489 [Step 2] Target SGSN sends a SGSN Context Request message to source SGSN to validate mobiles P-TMSI SGSN Context Request carries the following information elements Old P-TMSI Old RAI Old P-TMSI Signature

490 [Step 3 & 4] Some PDP context information (e.g., sequence number of the next packet to be sent to mobile) requested by target SGSN may be maintained by source RNC source SGSN will send an SRNS Context Request to source RNC to collect such information source RNC will stop sending downlink data to mobile and returns an SRNS Context Response message to source SGSN

491 [Step 5 & 6] Source SGSN will validate P-TMSI and act as follows upon positive validation of P-TMSI source SGSN will send a SGSN Context Response message back to target SGSN this message carries mobiles PMM context and PDP context these contexts contain critical information needed by target SGSN to handle the traffic to and from mobile

492 example PDP contexts describe mobiles active PDP contexts immediately before RA update target SGSN needs to update PDP contexts on mobiles GGSN during RA update if mobile was in PMM-CONNECTED state on source SGSN source SGSN could be sending packets to mobile immediately before RA update

493 to ensure in-sequence delivery of packets to mobile target SGSN needs to know the sequence number of the next user packet that should send to mobile

494 Footnote PMM context mobiles PMM context a set of information used by network to track mobile's location state of a mobiles PMM context determines which network connections (bearers) between mobile and SGSN should be maintained for mobile how network tracks mobiles location

495 Footnote (cont.) PDP Context a set of information maintained by a network node used to determine how to forward user packets destined to and originated from a particular PDP address PDP context GPRS/UMTS PDP context SGSN MS APN (Access Point Name) GGSN

496 Footnote (cont.) PDP Context Activation MS GGSN PDP Context MS QoS MS QoS PDP Context MS SGSN GGSN

497 Footnote: 3GPP PDP Context State Transitions

498 upon negative validation of P-TMSI source SGSN will send an appropriate error cause to target SGSN this will trigger target SGSN to initiate security procedures directly with mobile to authenticate mobile if authentication is also negative target SGSN will reject mobiles RAUR

499 if authentication is positive target SGSN will send another SGSN Context Request message to source SGSN to retrieve mobiles PMM context and PDP context this time, SGSN Context Request will carry mobiles IMSI, Old RAI, an indicator (MS Validated) to indicate that mobile has been positively authenticated

500 source SGSN will respond with an SGSN Context Response message carrying mobiles PMM context and PDP context if source SGSN has these information elements, or an appropriate error cause if source SGSN does not have these information elements