1. The UMU-PBNM Antonio F. Gomez Skarmeta Gregorio Martínez
<skarmeta,
University of Murcia
SPAIN

2. Agenda Objective and Proposed Architecture The UMU-PKIv6
UMU-PBNM Design
UMU-PBNM Implementation
Analysis of VPNs over IPv6
References

3. Objective and Proposed Architecture

4. UMU-PBNM Main Objective
Design and set-up a security framework to manage distributed communication systems using the PBNM paradigm
Features:
Flexible
Secure
Service and application-independent
Standard-based
IP-based
In collaboration with UCL-CS

5. Proposed Architecture
Trust Management
System
Policy Management Framework
Cryptographic
Middleware
Policy
Language
UMU-PBNM (Policy
Console, PMT, PDP,PEP)
UMU-PKIv6
Java Card
Network Layer Security Services
IPsec Security Services

6. The UMU-PKIv6

7. UMU-PKIv6 Description
Main Objective ... to establish a high security infrastructure for distributed systems
Main Features:
PKI supporting the IPv6 protocol
Developed in Java  running on every Operating System
Issue, renew and revoke certificates for every entity belonging to one organisation
Final users can use either RAs or Web browsers to make their own certification operations
LDAPv6 directory support

8. UMU-PKIv6 Description (II)
Main Features: (II)
Use of smart cards (file system, RSA or Java Cards) ... allowing user mobility and increasing security
PKI Certification Policy (CPS) support
VPN devices certification support (using the SCEP protocol)
Support for the OCSP protocol and Time Stamp
Web Administration
Supports DNSsec
Used in both Euro6IX and 6NET projects (cross-certification)

9. UMU-PKIv6 Architecture
LDAP
End
User
VPN Device
VPN Device
Administrator
End
End
User
User
DNSsec
Administrator
Administrator
Certification
Authority
Registration
Authority
Registration
Authority
Certification
Certification
WWW Secure
WWW Secure
Authority
Authority
Request Server
Request Server
Registration
Registration
Data Base
IPv6 SSL connection
IPv6 Plain connection
SCEP
Authority
Authority
SCEP
SCEP over IPv6
Data Base
Data Base

10. UMU-PKIv6 Architecture (II)
Certification Authority
OCSPResponder
TimeStamping
Responder
Time Stamp
Server
OCSP Server
TSPClient
Certificate
OCSP Client
msg_hash
time stamp
cert serial number
status
TSP Message
OCSP Message

11. UMU-PBNM Design

13. Policy Enforcement Point (PEP)
UMU-PKIv6
PMT
Policy DB
Decision
Taking
Monitoring
Network
PEP
Monitoring
PSIP
PEPs DB
OCSP
PSIP Client/Server
Policy
Adaptation
PDP
Config.
Criptography
Mangement
LDAP
Certificate
Validation
Policy Enforcement Point (PEP)
PSIP
COPS Server
COPS
Policy
Decision
Point
(PDP)

14. Policy Management Process

15. Monitoring Process

16. UMU-PBNM Implementation

17. Relevant Implementation Issues
Policy Console
Web Browser
Microsoft CSP (Cryptographic Service Provider)
PMT
Assistant module to define new policies
Managing and storing XML policy documents according to one XML schema
PDP and PEP
Using COPS and COPS-PR from Vocal 1.5
New S-Type for XML (and XML Path) added
PEP-Network Node interaction
VPN ETool

18. Analysis of VPNs over IPv6

19. IPsec/IKE Solutions Analyzed
Open-Source Solutions
FreeS/WAN 1.91 with IPv6 support v0.2 (Linux)
USAGI Stable Release 4 (Linux)
KAME-integrated in FreeBSD 4.6 (FreeBSD)
Commercial Solutions
Microsoft IPv6 (Windows XP)
Solaris 9
6WIND 6200 Edge Device

20. Designed Evaluation Plan
Objective: evaluate IPv6 IPsec/IKE interoperability and conformance
Background: TAHI Project (
But, different objectives:
Given an scenario, which is/are the more suitable implementation/s??
Interoperability tests
Test scenarios
Test suite
Final reports
Configuration and installations guides
Test reports

21. Designed Test Scenarios

22. Scenarios Used for Testing

23. Example Test Scenario Secure Gateway To Secure Gateway
Elements involved in the Scenario:
End Hosts … normal PC (1 GHz of CPU, 128 MGs of Memory) connected to a 10 Mbps Ethernet network
Secure Gateways:
PC Routers … normal PC (1 GHz of CPU, 128 MGs of Memory) connected to a 10 Mbps Ethernet network
6WIND 6200 Edge Router connected to a 10 Mbps Ethernet network
Router: CISCO 2600 connected to a 10 Mbps Ethernet network
Things to measure
Duration of the IKE negotiation (modified daemons)
RTT

24. Example Test Scenario (II)
Secure Gateway To Secure Gateway with ESP in Tunnel Mode

25. Results: Duration of IKE Negotiation

26. Results: RTT

27. Results: Conclusions Duration of the IKE Negotiation RTT But …
Use of certificates does not increment too much the delay
Interoperability implies a strong increment
RTT
Using authentication increases lowly the RTT
The use of IPsec increases in 15-20% the RTT
But …
It is real that implementations are far from being mature

28. References

29. Basic References
UMU-PKIv6 - Public Key Infrastructure with IPv6 support
VPN Enforcement Tool
UMU-Policy Mangement Tool (old version of the IPsec Policy Schema)

30. The UMU-PBNM Antonio F. Gomez Skarmeta Gregorio Martínez
<skarmeta,
University of Murcia
SPAIN