1. Mobile Networking Prasun Dewan Department of Computer Science University of North Carolina dewan@unc.edu

2. 2 Problem n How to provide mobility-transparent network access?

3. 3 INS Support for Mobility n Client never sees physical address u Query serves as intentional name for source and destination n Discovery infrastructure also does message routing n Conventional model u Get address from query u Use address to send message n INS model u Send message with query u What if multiple services F Anycast Send to service with least value of metric F Multicast Send to all matching services Cannot use internet multicast!

4. 4 INS Problem n New communication paradigm u Implemented on top of existing transport layer u Not as efficient? n Designed for interaction with mobile appliances n Not traditional applications on mobile nodes u No support for stream-based interaction

5. 5 Link-Level Support Migrating station

6. 6 Handoff Schemes n Some central server/router per wireless LAN knows MH and base station mapping u Old base station buffers messages and forwards to new one u Adjacent base stations join a multicast group and buffer messages n Works only for migration within a wireless LAN n Can build on the multicast and forwarding ideas?

7. 7 Building on Multicast Idea n Each mobile host has an associated unique internet multicast group n Moving from internet address A to B  u A leaves multicast group u B joins it n Multicast group provides the indirection. n Use of multicast here different from traditional multicast u Sparse groups n Efficient wide area multicast not available anyway

8. 8 Building on Forwarding Idea n A permanent home address assigned to a mobile host. n An agent able to intercept messages sent to that address keeps track of current location of host and forwards it to the new location.

9. 9 Excerpt from Zhang’00 n Start of excerpt

10. 10 Mobility at the Network Layer n Where can you manage mobility? u Application u Session u Transport u Network u Data-link u Physical n Mobile-IP: an extension to current IP architecture u To manage mobility at the IP layer u To hide mobility from the upper layers

11. 11 Terminology n Mobile Node (MN or MH) n Correspondent Node (CN or CH) n Home Network and Foreign Network n Mobility Agent u Home Agent (HA) and Foreign Agent (FA) n Home Address (HoA) and Care-of Address (CoA) n Binding and Binding Update

12. 12 IETF Mobile-IP: Basic Concept n MN always uses its home address HoA n When MN visits a foreign network, u Registration with FA F Discover mobile agents and CoA u Registration with HA F Binding update (HoA -> CoA) n When CN communicates with MN, it uses HoA n HA forwards packet from HoA to CoA

13. 13 Agent Discovery n Through Agent Discovery Process n Agent advertisement (beaconing): u Mobile agent broadcast agent advertisement at regular intervals (“I am here”) n Agent solicitation: u MN can solicit advertisement (“anyone here?”) u Mobile agent respond to agent solicitation n Question: u why agent solicitation?

14. 14 Functions of Agent Advertisement n Allow for the detection of mobility agents n Let the MN know whether the agent is a HA, or a FA n List one or more available care-of addresses n Inform the MN about special features provided by FA u Example: Alternative encapsulation techniques n Let MN determine the network number and status of their link to the Internet

15. 15 CoA n Two types of CoA: u FA’s IP address u MN’s temporary address F Locally-assigned address in the foreign network F E.g., DHCP address n Depends on foreign network configuration u Foreign network may or may not hand out addresses to visitors

16. 16 Implementing Agent Discovery n Protocol details u Built on top of an existing standard protocol: Router Advertisement (RFC 1256) u Simply extends the fields of existing router advertisements

17. 17 Registering CoA n HA must know a MH’s CoA (binding update) n Binding: (HoA->CoA) u Binding has a lifetime (can expire) n Registration process u MH sends a registration request with CoA information u HA authenticate the request u HA approves or disapproves the request u HA adds the necessary information to its routing table u HA sends a registration reply back to MH

18. 18 Registration Operations

19. 19 Authentication n A malicious node could cause remote redirect n Authentication and protection against replay attacks, and need for unique identification field u Timestamp and Pseudorandom Number

20. 20 Automatic Home Agent Discovery n Problem: what if MH never knew its HA? u Example: MH reboots and losses all states n Subnet-wise broadcast packet is sent to the home network u Subnet-wise broadcast: cell-cast n HA responds n If more than one, other HAs on the home network send rejection notice

21. 21 Forwarding to CoA n Encapsulation u Sending the original packet (CH->MH) in another packet (HA->CoA) n Default encapsulation mechanism: u IP-within-IP (tunnel) u Tunnel header: A new IP header inserted by the tunnel source (home agent) u Destination IP: CoA n Alternative encapsulation mechanism: u Minimal encapsulation

22. 22 Tunneling Operations in Mobile IP

23. 23 The Triangle Routing Problem n MH->CH: direct; CH->MH: CH->HA->MH u Inefficient n Solution: Route optimization in Mobile-IP u Deliver binding updates directly to CH

24. 24 Discussion n System issues

25. 25 Home Network n Where Can We Put the Home Agent? u At the router? u As a separate server? n At the router u What if there is multiple routers for the home network? n As a separate server u How can it pick up a packet [CH  MH]?

26. 26 Foreign Network n Where is FA? (Router or Separated Server?) n How Can FA deliver MH the packet [CH  MH] u Normally, [CH  MH] would go straight to a router (because MH is foreign) n Is There Adequate Support at A Foreign Network u What if there is no FA at the network you visit? u Co-located FA n What is the Minimum Requirement from the Foreign Network? u Keep it as small as possible

27. 27 Security Issues n Visitors Are Threats! u How to provision your LAN to support nomadic users u And to protect your LAN from nomadic users n Foreign Network Firewall Traversal u Can firewall allows inbound [HA  FA] tunnel? u Can [MH  CH] pass through an egress filter? F Bi-directional tunneling n Mutual Authentication u Can you trust MH? u Can you trust FA?

28. 28 Mobile Computing Model n What is the binding in IETF Mobile-IP? u HoA -> CoA (one level of indirection) n Where is the binding being managed? u HA u In the route optimization case: CH n Scale of mobility? u Internet-wide n What is a cell in Mobile-IP? u Subnet

29. 29 Further Discussions n Variants of IETF Mobile-IP u Implementation issues n Mobility Scope u Macro-mobility: Mobile-IP u Micro-mobility: Hierarchical Mobile-IP, Cellular- IP, HAWAII, TeleMIP, EMA, … F Combining network-layer mobility with link-layer mobility F Features: fast handoff, paging, etc. n Mobility in a higher layer u Transport layer, session layer

30. 30 Excerpt from Zhang’00 n End of excerpt

31. 31 Triangle routing from MH to SH n Needed to send messages to MH n Also for sending messages from MH n Mobile Host source address needs to be home address n But for security reasons, local network will not route messages with non- local submet mask u Like mail severs not forwarding messages if reply-to address is not local n So MH sends message to Home Agent with local care of address n Home Agent changes it to home address n Reverse tunneling n Thus triangle routing from and to MH

32. 32 Key Mobile Networking Ideas/Issues Location-independent ID u Home IP address, Multicast address n Dynamic binding of EID to location u Foreign agent contacting home agent u Joining/leaving multicast group n Binding may be stored remote and/or local to communicating party u Home agent stores it remote u Multicast groups stored remote and cached? F Cache refresh problem – need to determine where cached n Remote Binding may be accessed at u Connection time F What to do if binding changes after connection F Does not work for non connection-oriented communication (UDP) u Message delivery time F Mobile IP F Performance problem

33. 33 DNS based Solution Location-independent ID u DNS name n Dynamic binding of ID to location u MH gets IP address from local network (DHCP server) u DNS system of (home domain) informed about it F By DHCP server or MH n Binding may be stored remote and/or local to communicating party u DNS bindings replicated and cached u Time to live of cache 0 to avoid cache update F Of MH, not the name server holding the mapping F Search does not have to start at root u What if MH moves after address fetched from NS F Try again if TCP connection fails F Address is hint rather than absolute

34. 34 DNS based Solution n Remote Binding accessed at u Connection time F What to do if binding changes after connection Mobile TCP/IP

35. 35 Mobile TCP/IP n TCP connection identified by u u Need an ID that is address independent F Connection time, token returned F Now connection identified by u Moving end can send migrate message to other end F with connection ID and new address u This message not acked F Next message from stationary end to new address implicitly acks migrate message

36. 36 Migrate Architecture DNS Server Mobile Host foo.bar.edu Location Query (DNS Lookup) Connection Initiation Location Update (Dynamic DNS Update) Connection Migration xxx.xxx.xxx.xxx yyy.yyy.yyy.yyy Correspondent Host From snoeren’00

37. TCP Connection Migration 1.Initial SYN 2.SYN/ACK 3.ACK (with data) 4.Normal data transfer 5.Migrate SYN 6.Migrate SYN/ACK 7.ACK (with data) From snoeren’00

38. TCP Connection Migration 1.Initial SYN 2.SYN/ACK 3.ACK (with data) 4.Normal data transfer 5.Migrate SYN 6.Migrate SYN/ACK 7.ACK (with data) From snoeren’00

39. TCP Connection Migration 1.Initial SYN 2.SYN/ACK 3.ACK (with data) 4.Normal data transfer 5.Migrate SYN 6.Migrate SYN/ACK 7.ACK (with data) (Note typo in proceedings) From snoeren’00

40. 40 Race Conditions n Both end points migrate at same time u Solution assumes one fixed host n Migrating host’s old address reassigned before it has issued Migrate request n That would issue an RST message u Wait for migrate request before closing connection

41. TCP State Machine Changes MIGRATE_WAIT 2MSL timeout recv: SYN (migrate T, R) send: SYN, ACK recv: RST appl: migrate send: SYN (migrate T, R) recv: SYN (migrate T, R) send: SYN, ACK 2 new transitions between existing states - and - 1 new state handles pathological race condition From snoeren’00

42. 42 Security Issues n Third part can change DNS mapping u Secure DNS needed n Third party can move connection u Token prevents this n Replay attack u Sequence number of request prevents this n Denial of service u SYN Flooding u Token validation can be expensive u A simpler to validate token sent with actual token