Transcript Securing Binding Update between Mobile node and

20th APAN Network Research Workshop
Securing Binding Updates between
Mobile Node and Correspondent Node in
Mobile IPv6 Environment
Rahmat Budiarto
NAv6, USM
Introduction
 What is IPv6?
IPv6 is the next generation IP Address.
IPv6 = 2001:0468:0C80:1341:0280:1CFF:FE15:5820
Huge Number of addresses 2128 = 340 Undecillion Addresses
Built-in Mobility Support (Main Feature)
 Why do we need IPv6?
Limited addressing space in IPv4
Growing Internet Community

More laptops, Broadband service, Hotspots…
Growing Mobile Technology

3G Network, Nokia and Mobile phone service providers
 What is Mobile IPv6?
Mobile IPv6
Terms Used
 Mobile Node -a node which travels from one to another network
 Home Agent - Router in the Home network
 Correspondent Node - Node which Mn communicating with
 Home-of Address – Mn’s IP Address in Home Network
 Care-of Address - Mn’s IP Address in Foreign Network
 Binding Update - What is binding Update?
Binding Update
Binding update is the act of Mn,
To update its new Care of Address. (to HA & Cn)
•Between Mobile Node and Home Agent
(Current Protocol - IPSec)
•Between Mobile Node and Correspondent Node
(Current Protocol - Return Routability)
Scope and Background of the Paper

This paper is about Mobile IPv6 and Binding
Update. (only Mn and Cn)
Related Papers
 What others has done about Binding Update?
 Is it a current issue?
 Is it an interesting topic?
Literature Review / Related Work
1.
Securing return Routability protocol against Active
Attack



2.
Uses Modified RR and Digital Signature
Also use Public Key Cryptography for strong security
Conclusion : Public Key is very huge, not practical to implement
Mobile IPv6 route Optimization Security Design



Has made small enhancement to RR
Introduce time stamp for kbm (eliminate time shifting attack)
Conclusion : Introduce Route Optimization (Kbm expiration)
Literature Review / Related Work (continue)
3.
Early Binding Updates for Mobile IPv6



3.
Using IPSec between Mobile and correspondent IPv6 Nodes




4.
Introduces two Early Binding messages
Reduces the overall network latency
Conclusion : Provides a good performance Result
New approach introduced
Mostly based on assumption and needs more Security Association
Assumption made as manual selection and peer to peer based
Conclusion : Ambitious, need more enabled features. (future)
Dynamic Diffie-Hellman based key distribution for Mobile IPv6



Uses Diffie-Hellman key exchange method
Four message exchange, possible man-in-the middle attack
Conclusion : Lacks of Authentication, might need PKI or AAA
implementation
Methodology
Secret Key Binding Technique
New Approach to Secure Binding Update Between Mn and Cn to replace Return Routability
1. Pre-Binding Secret Key Exchange Method
•
Key Exchange Process in Home Network
•
Diffie-Hellman Key Exchange
•
Two Message Exchange
2. Secret Key Encryption Method
•
Process takes place in Foreign Network
•
2 Binding test message exchange
•
2 Binding update message exchange
Start
Mobility
Enabled?
No
End
Yes
Return
Diffie-Hellman
Key Exchange
No
DH Exchange
Successful?
Yes
Pre-Binding key Exchange
Complete
Pre-Binding Secret Key Exchange Method
Start
Process starts when
Mn Obtain New CoA
and Send
Binding Test Msg
Return
Return
Binding Test
msg received?
No
Yes
Binding Test
Reply send to
Mn thru HA
Mn send
Binding Update
to Cn
No
Cn will send Binding
Acknowledgement
to Mn
Binding Complete
Successfully?
Yes
Secret Key Encryption
Completed
Secret Key Encryption Method
Secret Key Binding Technique Scenario
Shown as per Flow Diagram
Home Network
Pre-Binding Key Exchange
Mobile Node
FF:01::01
Home-Of Address
FF:08::04
Home Agent
Secret Key Binding Technique
Completed
Internet
ISP
Correspondent
Node
Foreign Network 2
FF:84::05
Care-Of Address
Foreign Network 1
Secret Key Encryption
Implementation / Result

Simulation presented using Network Simulator 2
(NS2)



C++ (System Language) - Simulator Configuration
TCL (Scripting Language) - Topology Configuration
Results presented using Trace Graph utility.
Secret Key Binding Technique
How it works?
Pre-Binding Secret Key Exchange Method
This is the first step:
•Diffie-Hellman Key Exchange (2 messages)
Message from Mn to Cn / Cn to Mn (Home Network) MN={FF:01::01}
•Takes
place in Home Network
•After the Pre-binding Secret key Exchange, the
communication process continues as normal.
Secret Key Binding (Binding Test)
Second Method:
• Secret Key encryption step
•4 messages Exchange
Binding Test message from Mn to Cn (Encrypted with (S) {Sn , HoA , T , MnC})
•2 Binding Test messages
•2 Binding messages
Binding Test Reply from Cn to Mn thru HA (Encrypted with (S) {Sn , T , CnC})
Secret Key Binding (Binding Update)
Binding Update (Encrypted with (S) {Sn , T , H(MnC+CnC) , BU} )
Binding Acknowledgement (Encrypted with (S) {Sn , T , BA})
Protocol Achievement

The parameters used in Secret key Binding
Technique show how some of the major security
threats eliminated (Security)

Number of message exchange, time taken and
time delay show the performance efficiency of
the protocol (Performance)
Security Consideration
Return Routability
Procedure
Secret Key Binding
Technique
Authentication
Yes
Yes
Authorization
Yes
Yes
Confidentiality
Yes
Yes
Integrity
Yes
Yes
Non-Repudiation
No
Yes
Cryptography
No
Yes
*Security Threats
Security Consideration
Return Routability
Procedure
Secret Key Binding
Technique
Eavesdropping
Yes
No
Traffic Analysis
Yes
No
Masquerading
No
No
Reply Attack
No
No
Message Modification
Yes
No
Denial-of Service
No
No
Man-in-the-middle
No
No
False binding
No
No
*Possible Vulnerabilities
Performance Consideration
Number of Nodes Involved
Process Time Length
Average Network Delay
Total Number of Packets Exchange
Total Number of Bytes sent
Total Packets generated by Mn
Total Bytes sent by Mn
Secret Key Binding
Technique
Return Routability
Procedure
3
3
0.079s
0.127s
0.00346s
0.00537s
47
52
5132
10824
16
22
1908
4192
*Overall Performance of Mobile Network Simulation
Performance Measurement
Secret Key Binding Technique
Return Routability
Performance Efficiency measurement
& Comparison
SKB
RR
SKB
RR
SKB
RR
SKB
RR
1
1
10
10
100
100
1000
1000
79.0ms
12.7ms
81.7ms
129.6ms
819.6ms
1299.6ms
8199.7ms
12999.6ms
Total Number of packets
47
52
227
340
2027
3216
20027
32016
Minimum Network Delay
0.064ms
0.064ms
0.064ms
0.064ms
0.064ms
0.064ms
0.064ms
0.064ms
Maximum Network Delay
0.457ms
0.870ms
0.457ms
0.870ms
0.457ms
0.870ms
0.457ms
0.870ms
Average Network Delay
0.346ms
0.537ms
0.444ms
0.813ms
0.456ms
0.853ms
0.457ms
0.857ms
Number of Packet Loss
0
1
16
28
196
296
1996
2996
Number of Process
Total Processing Time
Performance Test has been conducted to test the efficiency of the protocol.
• Comparison made between RR and SKB
• 1 to 1000 processes in a scenario has been tested
• Shows the average delay of both protocol. Efficiency ≈ 50%
Secret Key Binding Performance Trace Output
Return Routability Performance Trace output
Contribution
New approach for Binding Update
 Secret Key Binding Technique

 Pre-Binding
Secret key Exchange Method
 Secret key encryption Method
Cryptographic Based Binding Method
 Improved performance

 Less
number of packet exchange
 Less time taken to finish the process
Conclusion
A new method has been introduced for BU
 Secret Key Binding Technique

 More
Secure (cryptographic Based)
 Better Performance

Space for future enhancement
Future Works

Enhancement to the DH key Exchange

IKE or AAA method can be used to
improve the Key Exchange Method
Thank You.
Rahmat Budiarto
20th APAN 2005
08/2005