Subject: RE: [Mipshop] HMIPv6 improvements in new list of MIPSHOP items fornew charter

From: "Soliman, Hesham" <[email-masked]>
Date: Thu, 12 May 2005 18:11:13 -0400

> => First, let me repeat the question I asked earlier during this
 > discussion (I never saw an answer for it): What do we want to address
 > in this draft? Is this to address a "different" way of securing
 > MN-MAP communication?
 > 
 > My particular concern is deployability of security.
 > 
 > W.r.t. authenticating and authorizing for HMIP service, in 
 > the Bootstrapping
 > DT, we discussed security for dynamic assignment of local 
 > home agent, and
 > there are some very difficult issues that could potentially tightly
 > constrain how a dynamically assigned local home agent could 
 > be deployed. A
 > HMIP MAP is very similar to dynamic local home agent. 
 > Assuming certs can be
 > deployed on all hosts, as the current draft does, is not 
 > realistic, though
 > it may be an option in some fairly limited circumstances.

=> I'll note that down on the concerns list. If someone 
agrees or disagrees please voice your opinion to help
set the goal for this work.

 > 
 > Also, I think it might be useful to say something about DoS 
 > attack. Any time
 > a network node address is handed out to a host, the 
 > potential for DoS attack
 > is there. To a certain extent, a MIP HA faces the same 
 > problem but it is
 > more limited. Since HMIP is proposing that MAPs become 
 > widely deployed as
 > part of access networks, there is a potential for widespread 
 > disruption of
 > service at the access network level if a DDoS attack is 
 > launched on an
 > operator's access network.

=> But do you have the same concern for other nodes like DNS, DHCPv6
(it allows direct communication), other local servers ...etc?
I guess I don't understand why this is specific to MAPs.

Hesham

 >             jak

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "James Kempf" <[email-masked]>
Date: Thu, 12 May 2005 15:45:23 -0700

DNS operators have evolved a set of procedures to use to counter the threat.
I believe something similar is needed with HMIP.

W.r.t. DHCPv6, from Section 3 of RFC 3315:

   Two advantages of IPv6 are that support
   for multicast is required and nodes can create link-local addresses
   during initialization.  The availability of these features means that
   a client can use its link-local address and a well-known multicast
   address to discover and communicate with DHCP servers or relay agents
   on its link.

This means that the scope of a DoS attack on a DHCP server can be limited to
a single link, making it easier to find and disable the attacker.

With HMIP, a MAP could be located at some distance from the links it is
covering (in fact, for good location privacy, it will have to be), requiring
that the MAP address be either globally routable or a Hinden-Haberman (don't
know what they're calling them these days) limited routable address. In
either case, the topological scope from which a DoS attack can be mounted is
considerably larger, making it difficult to impossible to quickly find and
disable the attacker.

            jak

---

From: "Junghoon Jee" <[email-masked]>
Date: Fri, 13 May 2005 10:45:49 +0900

Hi Soliman, 

>  > the Bootstrapping  > DT, we discussed security for dynamic 
> assignment of local  > home agent, and  > there are some very 
> difficult issues that could potentially tightly  > constrain 
> how a dynamically assigned local home agent could  > be 
> deployed. A  > HMIP MAP is very similar to dynamic local home agent. 
>  > Assuming certs can be
> > realistic, though  > it may be an option in some fairly 
> limited circumstances.
> 
> agrees or disagrees please voice your opinion to help set the 
> goal for this work.

I agree with James' observation about this.

>  >
>  > Also, I think it might be useful to say something about 
> DoS  > attack. Any time  > a network node address is handed 
> out to a host, the  > potential for DoS attack  > is there. 
> To a certain extent, a MIP HA faces the same  > problem but 
> it is  > more limited. Since HMIP is proposing that MAPs 
> become  > widely deployed as  > part of access networks, 
> there is a potential for widespread  > disruption of  > 
> service at the access network level if a DDoS attack is  > 
> launched on an  > operator's access network.
> 
> => But do you have the same concern for other nodes like DNS, 
> DHCPv6 (it allows direct communication), other local servers ...etc?

James, 
Clarifying question about the DoS/DDoS concern about MAP.
Why do you think that the DoS/DDoS attack is more severe with respect to the
MAP comparing to the MIP-HA ? 
I think that MIP-HA and HMIP-MAP can be regarded as the same level entity
which provides the MN's mobility service.
Losing the connectivity to the HMIP-MAP is not relevant to the network
access service like the case of MIP-HA.

Regards,
--Junghoon

> This email may contain confidential and privileged material 
> for the sole use  of the intended recipient.  Any review or 
> distribution by others is strictly  prohibited.  If you are 
> not the intended recipient please contact the sender  and 
> delete all copies.

---

From: "James Kempf" <[email-masked]>
Date: Fri, 13 May 2005 08:52:29 -0700

> access service like the case of MIP-HA.

I expect that an operator will have a fairly limited number of home agents
located in their core network. Therefore, it should be possible, from a cost
and deployment perspective, to make the home agents high performance, with
lots of redundency. And also possibly to have spares on line to bring up
should the original home agents be attacked. Finally, since the number of
home agents is limited, the operator can afford to have extremely high
bandwidth connectivity with lots of routing redundency going to and from
them so that an attacker would have to have enormous amounts of compute
power to take out all the home agents, and possibly to put various kinds of
firewall and monitoring in place around them to detect when a DoS attack is
happening. None of these measures is particularly cheap, but because the
operator only needs to do them once or perhaps twice, the cost is managable.

With HMIP, a MAP would have to be located in every access network. Most
wireless operators access networks are far larger than the core network. So
if an operator deploys HMIP, it would have to duplicate the same DoS
protection features across all its access networks, at a large increase in
cost. In some cases, because of physical constraints in the kind of
connectivity available, it is not possible to have extremely high bandwidth
connectivity in the access network, so there may be more constraints on the
deployment of MAPs. Such a deployment would be far more expensive than one
in which just Mobile IP is used.

Personally, I believe a localized mobility management solution that is part
of the routing infrastructure, in which there is no network entity address
required on the end host, is a better solution. Ideally, such a solution
would also be better for global mobility management, but interdomain IP
routing being what it is, such a solution is still a research topic, and,
anyway, I think Mobile IP can be made to work well enough at an acceptable
enough cost for now.

            jak