Subject: [netlmm] #140: Security goals should be more specific

From: netlmm <[email-masked]>
Date: Tue, 12 Sep 2006 19:59:57 -0000

#140: Security goals should be more specific
------------------------------------------+---------------------------------
 Reporter:  [email-masked]      |       Owner:  [email-masked]
     Type:  defect                        |      Status:  new                     
 Priority:  major                         |   Milestone:  milestone4              
Component:  draft-ietf-netlmm-nohost-req  |     Version:  2.0                     
 Keywords:  REQ draft                     |  
------------------------------------------+---------------------------------
 Sam Hartman (Security AD) filed the following DISCUSS comment (echoing
 what EKR said):

 I concur with the security directorate review's concern that this
 document cannot be reviewed before draft-ietf-netlmm-threats is ready
 to come to the IESG.  I'd like to see these documents come back on the
 same agenda for concurrent review.  I may add additional comments to
 this discuss at that time.

 and later:

 Goal 2.6 seems inappropriate in two ways.  First, I don't think no new
 security is a reasonable goal for its own sake; it may fall out of no
 software changes and that's fine, but "we don't want to make things
 more secure," doesn't seem like the message we're trying to send.
 Another part of 2.6 is the idea that we don't want additional
 credentials on the nodes because that would hurt deployment.  At one
 level that seems like a reasonable goal.  I'm concerned about how
 realistic it is in practice though for links that will require
 authentication of the IP-level movement detection.  We're going to
 need some credentials to make that work.  I don't understand how those
 credentials would be any different than credentials required by
 localized mobility management signaling.  Note that deploying this
 security will become more important in the netlmm case than in the
 current case because of the possibility of stolen IP addresses.  So,
 in short, I think you have the security deployment problem no matter
 how you look at it.

-- 
Ticket URL: <http://www1.tools.ietf.org/wg/netlmm/trac/ticket/140>
netlmm <http://tools.ietf.org/wg/netlmm/>
_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

---

From: netlmm <[email-masked]>
Date: Tue, 12 Sep 2006 20:10:07 -0000

#140: Security goals should be more specific
-------------------------------------------+--------------------------------
  Reporter:  [email-masked]      |       Owner:  [email-masked]
      Type:  defect                        |      Status:  closed                  
  Priority:  major                         |   Milestone:  milestone4              
 Component:  draft-ietf-netlmm-nohost-req  |     Version:  2.0                     
Resolution:  fixed                         |    Keywords:  REQ draft               
-------------------------------------------+--------------------------------
Changes (by [email-masked]):

  * resolution:  => fixed
  * status:  new => closed

Comment:

 Further modified Section 3.5 to encompass IP level movement detection
 security, with SEND as an example. The text already had SEND there, the
 movement detection link needed more emphasis. Edited text is below

 -----------------------------

 3.5     Simplify Mobile Node Mobility Management Security by Deriving from
 IP Network Access and/or IP Movement Detection Security (Goal #5)

 Localized mobility management protocols that have signaling between the
 mobile node and network require an additional security association between
 the mobile node and the network entity that is the target of the
 signaling, beyond the authentication and authorization required for simple
 network access. Establishing a security association specifically for
 localized mobility service in a roaming situation may prove difficult,
 because provisioning a mobile node with security credentials for
 authenticating and authorizing localized mobility management service in
 each roaming partner's network may be unrealistic from a deployment
 perspective. The additional security association also requires extra
 signaling and therefore extra time to negotiate. Reducing the complexity
 of mobile node to network security for localized mobility management can
 therefore reduce barriers to deployment and improve responsiveness.
 Naturally, such simplification must not come at the expense of maintaining
 strong security guarantees for both the network and mobile node.

 In NETLMM, the network (specifically the MAG) derives the occurrence of a
 mobility event requiring a routing update for a mobile node from link
 layer handover signaling or IP layer movement detection signaling. This
 information is used to update routing for the mobile node. The handover or
 movement detection signaling must provide the network with proper
 authentication and authorization so that the network can definitively
 identify the mobile node and determine its authorization. The
 authorization may be at the IP level, for example using something like
 SEND [3] to secure IP movement detection, or it may be tied to the
 original network access authentication and link layer authorization for
 handover. Some link layers, especially cellular protocols, feature full
 support and strong security for handover at the link level, and require no
 IP support for handover. If such link security is not available, however,
 then it must be provided at the IP level. If NETLMM security is tied to
 link layer authentication and authorization for network access, then such
 authentication and authorization is required on handover in order that the
 mobile node can be definitively identified. Security threats to the NETLMM
 protocol are discussed in [2].

 The goal is that security for NETLMM mobile node mobility management
 should derive from IP network access and/or IP movement detection
 security, such as SEND or network access authentication, and not require
 any additional security associations or additional signaling between the
 mobile node and the network.

---

From: netlmm <[email-masked]>
Date: Tue, 12 Sep 2006 20:10:43 -0000