Transcript PPT Version
IP Address Location Privacy and Mobile IPv6 draft-koodli-mip6-location-privacy-00.txt draft-koodli-mip6-location-privacy-solutions-00.txt Introduction • Mobile IP defines two IP addresses • Home Address (HoA) • The MN’s fixed identifier • Visible in all packets the MN uses whether on its home network or a visited network • Care of Address (CoA) • The MN’s routable address on a visited network • Visible in all packets sent from the visited network The problem • Roaming problem: • HoA on a visited network reveals user roaming to an on-looker • CoA reveals user roaming to a correspondent • Profiling problem: • As with any IPv6 address, an HoA or a CoA can be profiled for activity Profiling problem • Care of Address: • Can use privacy extensions to IPv6 (RFC 3041) • Could introduce additional Mobile IPv6 signaling • Home Address: • Using RFC 3041 addresses introduces DNS and IPsec considerations: • DNS: • DNS update Mobility Option in BU • Frequent updates (more than static HoA, and dynamic HoA) • DNS TTL has to be small • IPsec: • Since the MN – HA SA is keyed on HoA, frequent re-keying is necessary • Uses HoA as phase 2 identity (IKEv1) or Traffic-Selectorinitiator (IKEv2) Roaming Problem • Knowledge of CoA to a correspondent • Reverse-tunnel data packets • Knowledge of HoA to an on-looker • Reverse-tunneling: • ESP tunnel between MN and HA carries all traffic including Binding Update and Binding Acknowledgment • Route Optimization: • Replace HoA with a Label in both Binding Update and data packets • Packet formats in the solutions draft Privacy Label Computation • HoA should be recoverable from the Label • Label should be computable without HoA, since HoA should not be visible in any route-optimized packets (including BU) sent from the MN to CN • If BU is reverse-tunneled, the HoA is visible in the HA – CN path, but Label computation can include HoA • If BU is sent route-optimized, HoA is not visible at all, but needs addition of a bit to the HOTI message Label Computation • Privacy Label = String XOR HoA • String = First (128, HMAC_SHA1 (Kpm, (CoA | Home Nonce Index | Care-of Nonce Index))) • Kpm = Kbm for reverse-tunneled BU • Kpm = First (64, Kcn (HoA set to all zeros | nonce | 0)) Related Work • draft-qiu-mip6-hiding-movement-00.txt • draft-zhao-mip6-rr-ext-01.txt • draft-dupont-mip6-privacyext-00.html • Others?