1. Securing Access to Mobile Operator Core Networks using IKEv2
Master’s Thesis
Author Pekka Nurmi
Supervisor Joerg Ott
September 21, 2018

2. Agenda Background Methodology Security Protocols for IP Networks
Operator’s Network Architectures
Testing IKEv2 Implementations
Feasibility in Operator’s Environment
Conclusions
September 21, 2018

3. Background Amount and the value of the internet traffic grows
Insecurity of the networks, risks grow
IP based networks -> IP security (IPsec)
Enhanced version of the IPsec defined by the IETF in December 2005
New key exchange protocol IKEv2
more efficient
more secure
First implementations during 2006
need for testing in Mobile Operator’s environment
” Is the IKEv2 based Virtual Private Networks (VPNs) feasible in an operator’s network environment? ”
September 21, 2018

4. Methodology The study is conducted in three parts 1. Literature study
Security protocols for IP networks (IETF)
Operator’s network Architectures (3GPP)
Testing
3 Cases = 3 different IKEv2 implementations
Measurements using network analyzer tools
Feasibility evaluation
Operator solutions
Issues and improvements
September 21, 2018

5. Security Protocols for IP networks 1/3
IPsec
creates VPN tunnels and provides security for the insecure IP protocol
access control, connectionless integrity, data origin authentication, confidentiality, and anti-replay protection
Security protocols
Encapsulating Security Payload (ESP)
Authentication Header (AH)
Key management
Internet Key Exchange (IKEv2)
September 21, 2018

6. Security Protocols for IP networks 2/3
IKEv2
Key negotiation protocol for performing mutual authentication and setting up IPsec security associations
4 message exchanges
IKE_SA_INIT and IKE_AUTH
CREATE_CHILD_SA
INFORMATIONAL
MOBIKE
IKEv2 Mobility and Multihoming protocol
VPN client can move and change address without breaking the SA
New protocol; no implementations tested yet
September 21, 2018

7. Security Protocols for IP networks 3/3
IKEv2 authentication in operator’s network
AAA protocol (RADIUS, Diameter)
EAP-SIM
SIM card based authentication
EAP-AKA
for 3G
September 21, 2018

8. Operator’s Network Architectures 1/3
Access Networks
GERAN / UTRAN
WLAN
Core Network
CS & PS domains
AAA services
IMS services
September 21, 2018

9. Operator’s Network Architectures 2/3
IMS services using IKEv2
Tunneled connection to the operator’s PDG
September 21, 2018

10. Operator’s Network Architectures 3/3
Mobility management in IKEv2 (in 3GPP2)
MOBIKE for intra Access Network handoff
MIP for inter AN handoff
September 21, 2018

11. Testing IKEv2 Implementations 1/3
Case 1
IP based solution
laptop client (Linux)
Case 2
Mobile phone client (Symbian S60)
Case 3
3G and IP based solution (TTG)
2 clients
Laptop (Windows XP)
PDA (Windows Mobile 5.0)
September 21, 2018

12. Testing IKEv2 Implementations 2/3
Test Case Architectures
Cases 1 & 2
September 21, 2018

13. Testing IKEv2 Implementations 3/3
Case 3
September 21, 2018

14. Testing IKEv2 Implementations 4/4
Measurement results
September 21, 2018

15. Feasibility in Operator’s Environment 1/4
Present Situation
Approx. 86 % of organizations (turnover >10M€) in Finland used VPN solutions already in 2005.
Nearly 70% of mobile workers used VPN by 2006 in the U.S.
IPsec is the most popular VPN technology
VPN business is centralized between a few big vendors
September 21, 2018

16. Feasibility in Operator’s Environment 2/4
Solution 1
Hosted VPN access to an enterprise’s intranet
Same service for the 3G and IP (e.g. WLAN) access
SIM-card based authentication in both cases
September 21, 2018

17. Feasibility in Operator’s Environment 3/4
Solution 2
Bundle several secure network access elements in one package
Laptop/mobile phone
3G and WLAN
SIM-card
IKEv2/IMS VPN client
for enterpises and consumers
September 21, 2018

18. Feasibility in Operator’s Environment 4/4
Issues and Improvements
Choices for Clients
Interoperability
Mobility management
Signalling traffic optimization
September 21, 2018

19. Conclusions Secure connections are needed
IKEv2 and IPsec specifications provide enhanced IP security
IKEv2 implementations appear to be promising technology
A few important issues to solve with every tested implementation
IMS services can be used safely through an IKEv2 tunnel
Large-scale scalability testing needed
The old security solutions are still valid, but for how long?
September 21, 2018

20. The Nordic and Baltic telecommunications leader
September 21, 2018