Jan 2008 Richard Paine, BoeingSlide 1 doc.: IEEE /0120r1 Submission Next Generation Security for What is 21 st Century Security? Responsibilities VOIP/VoWLAN Reality Identity Solutions Architecture

Jan 2008 Richard Paine, BoeingSlide 2 doc.: IEEE /0120r1 Submission Security comes from certainty about "Who, What, Where, When, How and Why". Whatever adds to that certainty increases security, and whatever obscures that certainty decreases security. Certainty is about knowing the neighborhood, including identity, the regulatory domains, location, and surrounding equipment. What is Security?

Jan 2008 Richard Paine, BoeingSlide 3 doc.: IEEE /0120r1 Submission Today’s Wireless Security Tomorrow’s Security (for P2P VOIP) Fear Knowledge Low Quality Insecure on WLAN High Quality Secure on WLAN X X X Low Quality Insecure on WLAN Insecure on non High Quality Secure on WLAN Secure on non Near Future Wireless Security (w 11k, 11n, 11r, 11s, 11u, 11w, 11y, 11z) X X X X X Insecure on non Secure on non Low Quality Insecure on WLAN Insecure on non High Quality Secure on WLAN Secure on non X

Jan 2008 Richard Paine, BoeingSlide 4 doc.: IEEE /0120r1 Submission 21 st Century Security Shared medium (all wireless in regulatory domains) Identity Assurance Location Privacy Transition from Fear to Safety Assurance From Spoofing to Identity Protection Uncertainty Protection and Minor Risk Acceptance Weapons of Internet Offense and Defense Reliability Assurance (protection from DOS attacks)

Jan 2008 Richard Paine, BoeingSlide 5 doc.: IEEE /0120r1 Submission How Fits in 21 st Century Security Leading network standard (11ma, 11k,11n,11r, 11s, 11T, 11u, 11v, 11w, 11y, and 11z) Should be primary to deliver mobility/identity/location privacy/identity protection/uncertainty protection/independent from and the Internet Reliability assurance during handoffs (11k and 11r)

Jan 2008 Richard Paine, BoeingSlide 6 doc.: IEEE /0120r1 Submission Responsibilities leadership in an unwired world Independence from previous wired thought VoWLAN – issues (QoS, DOS, etc) Transition from ESS to P2P Enabling seamless secure wireless to wired (P2P as in VoWLAN) Enabling identity-based security wireless to wired (P2P as in VoWLAN)

Jan 2008 Richard Paine, BoeingSlide 7 doc.: IEEE /0120r1 Submission Leadership secure wireless (WPA and RSN) Transition to the wired network insecure AP is the source of the transition to the wired

Jan 2008 Richard Paine, BoeingSlide 8 doc.: IEEE /0120r1 Submission Previous Thought Security for wireless enough Applications must handle their own security Not the responsibility of the wireless realm in prime position to solve the problem

Jan 2008 Richard Paine, BoeingSlide 9 doc.: IEEE /0120r1 Submission Future Thinking Security end-to-end will require IEEE protocols (mobility and identity) VoWLAN will change the world IETF security not enough (HIP part of SMA) Transition to new thinking about Internet security (P2P) should step up to new thinking

Jan 2008 Richard Paine, BoeingSlide 10 doc.: IEEE /0120r1 Submission VoWLAN Issues 11u VoWLAN projects – ENUM – ECRIT 11e/WMM discrepancies – Not adequate for widespread VoWLAN – Failure of the QSE proposed work security only addresses ESS Must address wireless to wired security

Jan 2008 Richard Paine, BoeingSlide 11 doc.: IEEE /0120r1 Submission VOIP Reality VOIP will operate over both wired and wireless SIP reality is over both wired and wireless Secure communications is BSS/ESS and VPN (not secure past the VPN server) VOIP to demand secure voice comm IETF working on securing P2P (P2PSIP)

Jan 2008 Richard Paine, BoeingSlide 12 doc.: IEEE /0120r1 Submission VoWLAN Reality VoWLAN entering the BSS and ESS via wire VOIP requiring peer-to-peer or end-to-end secure voice communications must have an end-to-end and peer-to-peer transition and handoff solution

Jan 2008 Richard Paine, BoeingSlide 13 doc.: IEEE /0120r1 Submission End-to-End/Peer-to-Peer Tunnels SSL SIP/HIP (Host Identity Protocol)

Jan 2008 Richard Paine, BoeingSlide 14 doc.: IEEE /0120r1 Submission Transition from ESS to P2P Naming and Addressing –IP Addresses vulnerable –MAC addresses vulnerable –PKI Identity-based security associations OK IETF Middlebox Capabilities Potential Solution: AP must have middlebox features –HIP Middlebox possibilities or SSL Tunnel Handoffs

Jan 2008 Richard Paine, BoeingSlide 15 doc.: IEEE /0120r1 Submission Enabling Secure P2P – Wired and Wireless Possible Solutions –HIP –Secure Tunnels Security Solutions –IPv6/MIPv6 –Identity Based HIP 802.1x

Jan 2008 Richard Paine, BoeingSlide 16 doc.: IEEE /0120r1 Submission Identity-Based P2P HIP –Cryptographic Names/Identifiers –Security Associations –HIP-enabled communications Parity –Need ongoing parity –Overlap in BSS –Changing keys by symbol

Jan 2008 Richard Paine, BoeingSlide 17 doc.: IEEE /0120r1 Submission SMA Big Picture VPN WiMAXCellular Intranet Plane SCADAnet Plane Overlay Network Cell Subnet WiMAX Subnet HTTP PROXY Internet Plane VPN Subnet A Subnet B HIP MB AP Middlebox

Jan 2008 Richard Paine, BoeingSlide 18 doc.: IEEE /0120r1 Submission Boeing 2007 SMA/HIP Implementation smamobiles Boeing Intranet AAA Server DNS Namespace: mobile.tl.boeing.com Router AP … smaX Msg Brkr Directory DNS WiFi Switch TempCert RA Location Server LPDD HIP SA AP … SMAx VOIP Msg Brkr Directory DNS WiFi Switch TempCert RA Location Server LPDD Smamobiles VOIP HIP SA Boeing PKI Cellular Smamobile HIP SA Internet Robot Controller Robots HIP SA

Jan 2008 Richard Paine, BoeingSlide 19 doc.: IEEE /0120r1 Submission AP Middlebox –HIP Names/Identifiers Security Associations HIP-enabled communications Rendezvous Server –Tunnels +

Jan 2008 Richard Paine, BoeingSlide 20 doc.: IEEE /0120r1 Submission Possibilities Do Nothing Concede an P2P enhancement SG on P2P enhancements SG on NG security 11u address P2P in amendment 11u address VoWLAN in E911 Combination of and

Nov 2007 Richard Paine, BoeingSlide 21 doc.: IEEE /2787r1 Submission Q&A