Subject: Re: [mobile-ip] Mobile Routers support without optimization

From: James Kempf <[email-masked]>
Date: Mon, 20 Aug 2001 10:37:06 -0700 (PDT)

Erik,

>
>> Alex and I had an email exchange last week where I think we worked
>> out how it would be possible to do it. The MR exchanges a BU
>> with the CNs.
>
>And how do you propose solve the authorization issue for the BU?
>

Read further down the email and you'll see. 

>To the WG:
>
>I'm seriously starting to feel like a broken record - do people still feel
>like security can be added as an afterthought?
>Unless security (authentication and authorization) is thought of up front
>I don't see how the WG can make progress.
>

Please, Erik, I understand! :-) I'm just trying to explore the solution
space. If we find a solution that looks like it won't work due
to security, then let's discard it. It is not clear to me
that this one won't work at this point.

>> The security properties in this case seem, on first glance, to
>> be similar to regular MIP. The only issue is whether the MR
>> is allowed to route the prefix it claims it is allowed to
>> route. Even though the CN can authenticate the BU and CoA, it
>> does not necessarily mean that the node claiming to be a MR
>> is allowed to route the prefix. Perhaps something could be
>> set up through the HA when the CN first makes contact
>> with the MNN so that the HA could inform the CN that the MR
>> is allowed to route that prefix (or not, as the case may be).
>
>
>And when the HA and MR conspire to fool a random CN?
>

Basically, if I understand correctly, most solutions for the MIPv6 BU security
problem are not proposing that the CN and MN obtain an authentication
that the MN is who it says it is but just that the MN is the same one the CN was 
talking to before, and thus that that the MN is allowed to tell the
CN via a BU to change the routing. In order to have the CN authenticate that
the MN is who it says it is, there would need to be some out of
band exchange of secure information that the CN could later fall back
on to authenticate the MN, correct? And this is clearly too onerous
for a random CN/MN exchange.

I think trying to prevent the HA and MR from fooling a random CN
falls into the same category as requiring the CN to  authenticate
that the MN is who it says it is. This would require an out of
band exchange of secure information. Now, there may be good reasons
why this requrement should be imposed on MR/CN route optimization
and not on MH/CN route optimization, but if so, I think we need
to spell them out.

A similar requirement to MH/CN route optimization might go as follows.
Since the subnet prefix that the MR sends in the BU must be on the home subnet 
of the MR, one can require that the HA route a subnet that includes, under it, 
the subnet routed by the MR. Since the HR controls the routes to that prefix, it 
should be able to tell the CN whether the MN is authorized to provide routing 
updates.  The CN can verify that the MR is the same one that it talked to before 
by the solution for MIP host BU security. The additional requirement is some
sort of security exchange initially between the CN and HA that
allows the HA to inform the CN that the MH home address is for a MR and
that the MR is allowed to change routing for the subnet.

>
>> It seems somewhat impractical to require that nodes behind a
>> mobile router be mobile aware. What if I buy a laser printer for
>> my cruise ship network? Or bring one along on a cruise? It probably isn't
>> mobile  aware. 
>
>But you might not need to optimize for random CN's accessing your printer :-)
>
>Seriously, there might be some relationship between devices being globally
>accessible and wanting to be MNs in their own right, which might feed
>into thinking about where optimizations make sense.
>

The issue I see is whether there needs to be something "extra" in
MNNs on mobile subnets. The "extra" is in addition to a static
IPv6 node or a MIPv6 node. Anything "extra" complicates implementations
and is a barrier to deployment and usability. So if there does
need to be something "extra". IMHO it had better be really necessary,
and it might be an argument for waiting and coming up with
a comprehensive solution to the MR problem. So it would seem that
a solution which doesn't require something "extra" would be preferable,
though maybe not achievable after detailed examination.

		jak

---

From: Alexandru Petrescu <[email-masked]>
Date: 21 Aug 2001 12:39:52 +0200

James Kempf <[email-masked]> writes:
> Since the subnet prefix that the MR sends in the BU must be on the
> home subnet of the MR, one can require that the HA route a subnet
> that includes, under it, the subnet routed by the MR. Since the HR
> controls the routes to that prefix, it should be able to tell the CN
> whether the MN is authorized to provide routing updates.  The CN can
> verify that the MR is the same one that it talked to before by the
> solution for MIP host BU security.

Me too I see it this way.

As I said earlier, I'm wondering it's feasible to put a requirement
that "the subnet prefix that the MR sends in the BU must be on the
home subnet of the MR".

As a counterexample against this requirement, there's a case when I
take two ISP's, one gives me a prefix, the other gives me another
prefix.  I keep one prefix for my home and the other for my PAN.  But
this is also something like being at home at linking the two ISP's
together, not very nice.

Alex