Internet Goes Mobile Alper Yegin KIOW 2003 at APNIC 16 August 19th, Seoul, Korea

1 Internet - Yesterday Internet DSL Home Network Dial up Home user T1 Enterprise Network

2 Internet - Today and Tomorrow Internet DSL Home Network DSL Home Network Mobile Network GPRS Dial up Home user W-CDMA T1 Enterprise Network Operator Network Community Network PAN

3 Challenge Users expect the same characteristics (greedy!) –Secure –Reliable –Seamless –High performance Burden is on: –Standards bodies (IETF, IEEE, 3GPP, 3GPP2, etc.) –Vendors –Operators

4 Security First things first! Physical security is replaced with crypto- based security –Threats: Eavesdropping, spoofing –Not a full replacement! Crypto designs and experts get a good exercise!

5 Solutions Good solutions: –3GPP, 3GPP2 Bad solutions –IEEE WEP fiasco! Practical but less than adequate solutions: –WECA WISPer: HTTP redirect and web-based login hackery Practical and reasonable solutions: –IEEE b access outside VPN gateway

6 The Right Solution Authenticate, authorize the client Accounting and privacy Home Network Visited Network host AP Access Router Home AAA ISP AAA PANA, 802.1X Diameter, RADIUS

7 The Right Solution IETF AAA, EAP, and PANA Working Groups IEEE i, 802.1aa Home Network Visited Network host AP Access Router Home AAA ISP AAA PANA, 802.1X Diameter, RADIUS

8 Global AAA AAA web of trust is here (unlike global PKI) and more capable. Home Network Visited Network AAA server AAA server Visited Network AAA server Home Network AAA server AAA broker AAA broker

9 Impact Security is never plug-and-play (plug-and-get- hacked!) Additional infrastructure –Front-end AAA servers (NAS) –Backend AAA servers (RADIUS, Diameter servers) –VPN gateways Configuration –On the clients –Per-client configuration on the servers (keys, authorization parameters, etc.) –Configuration to join the AAA web-of trust

10 Impact Increased popularity of IPsec and TLS –AAA requires confidential information exchange –VPN –Anonymizer.com Strengthening internal network is a MUST –Unless you are 100% sure that wireless access is secure –Partitioning, IDS, enforcing strict policy execution (social aspects)

11 But Still …. You are vulnerable to attacks! Price of going wireless

12 Mobility Management Host at home (fixed Internet). Home Network Visited Network Web server host a::1 AP Access Router Access Router Access Router Access Router a::/64 AP

13 Mobility Management You move, you break! Home Network Visited Network Web server AP Access Router Access Router Access Router Access Router host b::1 b::/64

14 Mobile IP IETF Mobile IP Working Group – Home Network Visited Network Web server host b::1 AP Access Router Access Router Access Router Access Router Home Agent APb::/64 a::1  b::1 home address care-of address

15 Mobile IP Traffic tunneled through home network Home Network Visited Network Web server host b::1 AP Access Router Access Router Access Router Access Router Home Agent APb::/64

16 Mobile IP End-to-end signaling for route optimization Home Network Visited Network Web server host b::1 AP Access Router Access Router Access Router Access Router Home Agent APb::/64 a::1  b::1 home address care-of address

17 Mobile IP Most direct path for data traffic. Home Network Visited Network Web server host b::1 AP Access Router Access Router Access Router Access Router Home Agent APb::/64

18 … Fast and Smooth Problem: Signaling latency. Home Network Visited Network Web server host c::1 AP Access Router Access Router Access Router Access Router Home Agent AP c::/64 a::1  c::1 new care-of address

19 … Fast and Smooth Fast Handovers –draft-ietf-mobileip-fast-mipv6-06.txt IETF Seamoby Working Group – Home Network Visited Network Web server AP Access Router Access Router Access Router Access Router Home Agent AP c::/64 b::1  c::1 host c::1 old care-of address new care-of address

20 … Fast and Smooth Context transferred and routes fixed. Home Network Visited Network Web server AP Access Router Access Router Access Router Access Router Home Agent AP c::/64 host c::1

21 … Privacy Hide precise location and movement. Home Network Visited Network Web server host d::1 AP Access Router Access Router Access Router Access Router Home Agent AP d::/64 c::/64 b::/64 cafeteria CEO’s office employee office

22 … Privacy Obtain an IP address from the localized mobility agent. Home Network Visited Network Web server host d::1 AP Access Router Access Router Access Router Access Router Home Agent AP d::/64 c::/64 b::/64 Localized Mobility Agent e::1  d::1 e::/64 a::1  e::1 regional care-of address local care-of address home address

23 … Privacy Correspondent sends packets directly to the agent. Agent tunnels them to the precise location. Home Network Visited Network Web server host d::1 AP Access Router Access Router Access Router Access Router Home Agent AP d::/64 c::/64 b::/64 Localized Mobility Agent

24 … Privacy Correspondent does not know the real IP destination, or when it changes. Home Network Visited Network Web server AP Access Router Access Router Access Router Access Router Home Agent AP c::/64 b::/64 Localized Mobility Agent host b::1

25 … AAA Mobility management is a for-profit “service” Home Network Visited Network Web server AP Access Router Access Router Access Router Access Router Home Agent AP c::/64 b::/64 Localized Mobility Agent host b::1 Home AAA ISP AAA

26 … Network is Mobile IETF NEMO Working Group – Visited Network Access Router Access Router Access Router Base Station Base Station Base Station

27 Impact on Intranet More stateful servers –Home agents, access routers (for context transfer and fast handovers), localized mobility agents –Mobile IP bindings, tunnels, host-routes –Redundancy and fault-tolerance are MUST! More configuration –Per client on the servers –Trust relations among communicating servers

28 Impact on Internet/Intranet Tunnels –Several levels of nesting Web server Home Agent Localized Mobility Agent Previous Access Router host Current Access Router Fast Handovers Localized Mobility Management Mobile IP Home Address (Regional) Care-of Address (Older local) Care-of Address (Current local) Care-of Address

29 Impact on Internet Address consumption –Always-on hosts –Purpose-specific address usage (home address, care-of address) –Multihomed devices (GPRS, IEEE b, Bluetooth) –Sensor networks

30 Impact on Internet Suboptimal routing, redirect servers host A host B Home Agent A Home Agent B

31 Host Assumptions Can be anything: Dynamic auto-configuration needed: –IPv6 address auto-configuration (RFC 2462) –IPv6 prefix delegation (draft-troan-dhcpv6-opt-prefix- delegation-02.txt) –Service discovery (IPv6 anycast address support)

32 IPv6 IPv6 benefits: –Ability to run server apps on devices (accept incoming connections) –Plug-and-play –End-to-end IPsec for thwarting first-hop and last-hop threats –Mobile IPv6 : Efficient, easy to deploy and manage, and scalable mobility protocol –Extensibility Mobile and wireless Internet will expedite the transition from IPv4-NAT to IPv6

33 Conclusion Wireless and mobility provide tremendous benefits, but they come with a price. Transitioning the Internet protocols, architectures, products, and running networks should be done very carefully.

Questions?