Presentation is loading. Please wait.

Presentation is loading. Please wait.

Robert Moskowitz, Verizon

Similar presentations


Presentation on theme: "Robert Moskowitz, Verizon"— Presentation transcript:

1 Robert Moskowitz, Verizon
March 2012 Project: IEEE P Working Group for Wireless Personal Area Networks (WPANs) Submission Title: KMP Transport Proposal Date Submitted: March 15, 2012 Source: Robert Moskowitz, Verizon Address 1000 Bent Creek Blvd, MechanicsBurg, PA, USA Voice:+1 (248) , Re: Key Managementn over 4e Multipurpose Frames Abstract: Proposal for tg9 document structure and content Purpose: To add Key Management capabilities to 15.4 and 15.7 Notice: This document has been prepared to assist the IEEE P It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein. Release: The contributor acknowledges and accepts that this contribution becomes the property of IEEE and may be made publicly available by P Robert Moskowitz, Verizon

2 Key Management Support for 15.4 and 15.7
March 2012 Key Management Support for 15.4 and 15.7 Robert Moskowitz Waikoloa, HI March 15, 2012 Robert Moskowitz, Verizon

3 Changes from prior Version
March 2012 Changes from prior Version Change IE format to 'multipurpose' chaining Add 1 byte to KMP fragment to identify which KMP for the KMP multipurpose IE. Robert Moskowitz, Verizon

4 March 2012 Abstract To provide for a Key Management Protocol Transport for and .7 KMP agnostic Support: HIP, IKEv2, 802.1X, ... Provide recommended functionality for KMPs Use Information Elements From 15.4e for 15.4 How for 15.7? Robert Moskowitz, Verizon

5 KMP Transport Frames and State Machine
March 2012 KMP Transport Frames and State Machine Fragmentation Support KMP packet size WILL exceed MPDU Forced fragment chaining for simplification Concurrent KMP sessions Security Association content What keys? PTK, GTK, etc. Counters, lifetimes, etc. Robert Moskowitz, Verizon

6 15.4 Specifics 15.4 MAC and IE formats March 2012
Robert Moskowitz, Verizon

7 KMP Information Element
March 2012 KMP Information Element Frame format MAC specific content ID Length Control Field – 1 byte KMP fragment Bits:1 7 Octets: Chaining Flag MultiID/Count KMP Fragment 0-1 0-127 -- Robert Moskowitz, Verizon

8 KMP Transport Frames and State Machine
March 2012 KMP Transport Frames and State Machine Control Field 1 bit chaining flag (yes, last/onlyone) 7 bit Multipurpose ID/Chain count First packet provides Multipurpose ID ID range , 97 & 127 reserved ID=98 for KMP Chain Count Ends at 96 to disambiguate ID from count C=1 is 1st fragment C=2 is 2nd fragment 96 fragments SHOULD provide for at least 6KB KMP payload Robert Moskowitz, Verizon

9 KMP Transport Frames and State Machine
March 2012 KMP Transport Frames and State Machine KMP fragment KMP ID – 1 byte 802.1X, HIP, IKEv2, SAE, etc. KMP payload Robert Moskowitz, Verizon

10 15.4 Specifics 15.4 MAC and IE formats March 2012
Robert Moskowitz, Verizon

11 15.4 Specifics Use 15.4e Information Elements
March 2012 15.4 Specifics Use 15.4e Information Elements Use data payload IEs (not header IEs) Larger payload length Header IEs limited to 127 bytes Need IE type assignment MLME Nested limited to 255 bytes Only 5 values available Robert Moskowitz, Verizon

12 15.4 Specifics MAC and IE details IE ID Value assignment March 2012
Only 5 values available Thus the move to a 'multipurpose' chain ID with sub-field for KMP IDs Thus similar to MLME (Nested) but as a data IE Robert Moskowitz, Verizon

13 15.4 Specifics MAC and IE details
March 2012 15.4 Specifics MAC and IE details Unauthenticated PDUs always use long addresses e.g. KMP rekeying within authenticated PDUs MAY use short addresses Use Forced ACK for chaining support For pre-4e devices work with IETF on 6lowpan support Robert Moskowitz, Verizon

14 15.4 Specifics MAC and IE details ACK frame used for chaining
March 2012 15.4 Specifics MAC and IE details ACK frame used for chaining Robert Moskowitz, Verizon

15 15.4 Specifics Pre 15.4e device support For 6lowpan PANs March 2012
Develop a submission to the IETF using the Dispatch Type in RFC 4944 PDUs with the KMP Dispatch Type a length field will be equivalent to the 15.4e KMP IE A 6lowpan device that supports 15.4e SHOULD also support this pre-15.4e mode of operation Who wants to author this? Robert Moskowitz, Verizon

16 15.4 Specifics Security Association content
March 2012 15.4 Specifics Security Association content section 7.5, table 60 SA per link pair Broadcast SA(s) may be KMP specific 1 per source? Shared key space with sequence including source MAC? How to control rekeying will be KMP specific Robert Moskowitz, Verizon

17 15.7 Specifics Use 15.7 Information Element Command
March 2012 15.7 Specifics Use 15.7 Information Element Command Can a Command frame ONLY have IEs? Sec 5.3 seems to indicate that the MLME has no way to construct a command frame with ONLY IEs. Need Element ID assignment Use Forced ACK for chaining support Robert Moskowitz, Verizon

18 15.7 Specifics Use 15.7 Information Element Command March 2012
Robert Moskowitz, Verizon

19 15.7 Specifics Use 15.7 Information Element Command
March 2012 15.7 Specifics Use 15.7 Information Element Command Need Element ID assignment Robert Moskowitz, Verizon

20 15.7 Specifics Use 15.7 Information Element Command
March 2012 15.7 Specifics Use 15.7 Information Element Command IE length of 255 bytes max may be too limited IE Command allows for multiple IEs per command KMP IE MAY have larger IE? Robert Moskowitz, Verizon

21 15.7 Specifics Use 15.7 Information Element Command
March 2012 15.7 Specifics Use 15.7 Information Element Command IE payload same as in 15.4 ACK frame used for chaining Robert Moskowitz, Verizon

22 15.7 Specifics Security Association content
March 2012 15.7 Specifics Security Association content section 7.5, table 66 Needs study SA per link pair Broadcast SA(s) may be KMP specific 1 per source? Shared key space with sequence including source MAC? How to control rekeying will be KMP specific Robert Moskowitz, Verizon

23 KMP Guidelines KMP Sections General KMP description Use case(s)
March 2012 KMP Guidelines KMP Sections General KMP description Sub sections as needed, e.g. backend authentication mechanism Use case(s) Profile References to defining documents Parameter specifics, e.g. in HIP, K=0 SA definition E.G. Tie into security PID Robert Moskowitz, Verizon

24 KMP Guidelines Initial list of KMPs 802.1X
March 2012 KMP Guidelines Initial list of KMPs 802.1X Needs to include an actual key exchange like the i 4-way handshake HIP – R. Moskowitz/J. Haapola IKEv2 – T. Kivinen PANA – Yoshihiro Ohba SAE Robert Moskowitz, Verizon

25 KMP Guidelines KMP Profiling for 15.9 usage Change in encapsulation
March 2012 KMP Guidelines KMP Profiling for 15.9 usage Change in encapsulation e.g. IKEv2 specified to run over UDP Additions for SA management e.g X does not supply link keys. In usage, this is done via the 4- Way Handshake Special attention to broadcast keying management Others? Robert Moskowitz, Verizon

26 KMP Guidelines KMP use cases Why this KMP? Practical examples
March 2012 KMP Guidelines KMP use cases Why this KMP? Code size, CPU/battery demand Multi-layer code reuse Practical examples Deployment advice Identity installation and registration When performed Life-cycle management Rekeying Robert Moskowitz, Verizon


Download ppt "Robert Moskowitz, Verizon"

Similar presentations


Ads by Google