Subject: [Fwd: identity in binding updates]

From: Thierry Ernst <[email-masked]>
Date: Thu, 15 Feb 2001 15:17:27 +0100

Sorry if you receive this mail twice, but apparently it was not posted
on the Mobile IP mailing list and I don't see it in the archives. 
Apparently the Mobile-IP mailing list is not working anymore ...

Thierry.

Subject: Re: identity in binding updates
From: Thierry Ernst <[email-masked]>
To: Michael Thomas <[email-masked]>
Cc: [email-masked]
Date: Wed, 14 Feb 2001 11:46:55 +0100

Hi Michael,

See my comments bellow.

> The current ip6 version of mobility allows the MN
> to cause a routing table change to be made at CN
> and HA by use of a Binding Update destination
> option. There are somewhat analogous things that
> happen ip4, so this discussion is relevant there
> too, but I wanted to put it into v6 terms to
> illustrate the problem.
> 
> Because of the significant denial of service
> attack possible, the binding updates must be
> cryptograpically secured to make certain that they
> arrive from an authenticated and authorized
> source. While I readily see how IPsec provides
> authentication for the BU's, what seems to be
> missing -- and maybe I've just not looked in the
> right place which is quite possible -- is any
> reference to how the HA/CN _authorizes_ an
> incoming binding update: 

This issue has been discussed during last IETF San Diego meeting in
december - many mails where posted on this mailing list, which you will
find in the archives.   Yes, there is an authorization issue in Mobile
IP.    Being authenticated does not mean that you have the right to do
what you pretend to do.   And there is no solution yet.

> just because I can
> authenticate as [email-masked] doesn't mean that I
> should be allowed to send a binding update for a
> subnet that I don't own. Like, say, 127.0.0.0/8
> just for fun.

A Mobile Node can not send a Binding Update for a subnet.     Not only
the Mobile IPv6 specification does not allow it, but the HA/CN won't
know what to do with such registration.     Binding Update are for a 128
bit address, not for a prefix.

> The seeming implication to my poor head is that
> there needs to be a binding between an identity
> and the subnet(s) that that identity is allowed to
> make routing updates for. Or maybe even that the
> actual identity is, in fact, the subnet itself.
> 
> I think this issue is compounded when you consider
> mobile routers. In the normal IP model, hosts and
> routers always implicitly delegate routing update
> responsibility/authority to their downstream
> containing subnet owner. Also: the non mobile
> assumption is that routing adjacencies have static
> pairwise trust arrangements.
> 

There have actually been some work on this topic.   I would recommend
you to read my internet draft on the matter, which I have presented a
last San Diego.

"Mobile Networks Support in Mobile IPv6"
 draft-ernst-mobileip-v6-network-01.txt

http://www.inrialpes.fr/planete/people/ernst/Documents/draft-ernst-mobileip-v6-network.txt

And the PPT presentation I made:
http://www.inrialpes.fr/planete/people/ernst/Documents/ernst-monet-49IETF-SD.ppt

My draft discusses about Mobile Networks (exactly what you are speaking
about - a mobile router and the hosts behind the mobile router).   
Basically, Mobile IPv6 DOES NOT support Mobile Routers.    It does allow
communication with a Mobile Router but not with the hosts behind it.

> Mobile IP, and especially mobile routers, turns
> that assumption on its head: the routing
> adjacencies are dynamic and as a consequence the
> trust arrangement must be as well. Also, it
> doesn't seem entirely clear what the semantics are
> for the necessary binding updates from a mobile
> router -- I'm assuming that the BU's ought to come
> from the mobile router instead of the host behind
> the mobile router, which seems to imply that you
> need to have scoping on the identities (eg, the
> identity would need to incorporate the subnet mask
> too).

You've got the point.   What I call "Prefix Scope Binding Update" in the
draft.
 
> Has there been any work on this? The global
> implications here seem pretty far reaching, but
> I don't see how you can just handwave it away.

I was looking for comments like this.      This issue was first raised
at IETF Pittsburgh, but it didn't seem to made much interest at the time
being.   May be the topic is not fashionable yet, but if we want to put
IPv6 everywhere,  and be mobile, we need to address the issue of Mobile
Routers (i.e. networks) support.   I can see many applications.  Cars,
train, planes, but also more ad-hoc things such as PANs and Ad-Hoc
networks.

The question of authorization is even a more important one if we want
Mobile IPv6 to ever be deployed ...

Thank you for your interest, and please comment about our internet
draft.
Thierry.

--
* mailto:[email-masked]  Tel +33 (0) 4 76 61 52 69 
* INRIA Rhone-Alpes Projet PLANETE
* MOTOROLA Labs Paris
* http://www.inrialpes.fr/planete/people/ernst/Welcome.html