Subject: [Mipshop] HMIPv6 security discussions in Paris

From: "Soliman, Hesham" <[email-masked]>
Date: Sat, 30 Jul 2005 13:07:27 -0400

Folks, 

Please consider this email as an input to the discussion
on HMIPv6 security in Paris. 

Issues were raised recently about the deployability of the 
current security scheme in HMIPv6, which relies on IKE and 
IPsec. I intend to address those issues in the meeting
and discuss ways of moving forward. However, we should also
use the meeting time to discuss what the real problem is
and whether we collectively have the same understanding. 

As an introductory note, I want to use this email to present the 
different trust models that can exist today and how the current
scheme fits within those models. The following two models of deployments
cover pretty much all cases from a security point of view:

A. Authentication-only model

In this deployment model, the only requirement from a MAP point 
of view is authentication. I.e. all that is needed is to ensure
that the same MN is sending the BUs to the MAP. It is not necessary
for the MN to prove that it is authorised to use a MAP to manage
its mobility. Therefore, opportunistic IPsec is sufficient.
IKE with dynamic keying and IPsec are sufficient to handle this 
deployment case. 

A timely example of this case is the IETF network, public networks
with access control, enterprise networks ...etc

B. Authentication and Authorization model.

In this deployment model authentication-only is not sufficient.
The MAP and the MN need to know that the other end is "trusted".
The MAP also needs to know that the MN is authorised for using
it. Hence, the use of IKE with dynamic keying (Certs) will need
to ensure that there is an IKE policy in place to allow the MAP
to verify the MN's certificate. 

This model is probably most applicable to two main cases:
  B.1 A roaming scenario
  B.2 A scenario where an operator offers fixed and mobile service, 
      where some MNs are allowed to be mobile and others are not.

Note that any network can choose to deploy based on either scenario
depending on its requirements. The examples given above are based
on personal opinion and do not imply strict binding between those 
types of networks and the deployment requirements. 

The current security scheme in HMIPv6 handles cases A and B. However,
the issues raised against the security scheme used were concerned
with the ease of deployment of certificates on hosts. 

This is what I intend to address in the presentation in Paris. 
The outline of the presentation will be:
- Current security mechanism
- Above scenarios
- Issues with use of Certificates on hosts
- Way(s) forward. 

See you there.

Hesham

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: Alper Yegin <[email-masked]>
Date: Sun, 31 Jul 2005 04:59:53 -0700

> with the ease of deployment of certificates on hosts.

If you use EAP/IKEv2, you don't have to rely on client-side certs.

Alper