Subject: FW: identity in binding updates

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Wed, 14 Feb 2001 23:02:04 +0100

I'm forwarding this again. hopefully the mailing list 
will work before the WG is closed ! Or is this an 
early warning like they do in clubs !!!

> Michael, 
> 
> 
> 
> [please keep me on the reply-to line as I'm
>  still not subscribed to mip]
> 
> The current ip6 version of mobility allows the MN
> to cause a routing table change to be made at CN
> and HA by use of a Binding Update destination
> option. There are somewhat analogous things that
> happen ip4, so this discussion is relevant there
> too, but I wanted to put it into v6 terms to
> illustrate the problem.
> 
> Because of the significant denial of service
> attack possible, the binding updates must be
> cryptograpically secured to make certain that they
> arrive from an authenticated and authorized
> source. While I readily see how IPsec provides
> authentication for the BU's, what seems to be
> missing -- and maybe I've just not looked in the
> right place which is quite possible -- is any
> reference to how the HA/CN _authorizes_ an
> incoming binding update: just because I can
> authenticate as [email-masked] doesn't mean that I
> should be allowed to send a binding update for a
> subnet that I don't own. Like, say, 127.0.0.0/8
> just for fun.
> 
> The seeming implication to my poor head is that
> there needs to be a binding between an identity
> and the subnet(s) that that identity is allowed to
> make routing updates for. Or maybe even that the
> actual identity is, in fact, the subnet itself.
> 
> => You might find some help in the archives. 
> There was a long discussion about this after 
> the San Diego meeting. For the HA you would
> use a static SA as explained in another mail. 
> The problem is more relevant for the CN .
> 
> I think this issue is compounded when you consider
> mobile routers. In the normal IP model, hosts and
> routers always implicitly delegate routing update
> responsibility/authority to their downstream
> containing subnet owner. Also: the non mobile
> assumption is that routing adjacencies have static
> pairwise trust arrangements.
> 
> Mobile IP, and especially mobile routers, turns
> that assumption on its head: the routing
> adjacencies are dynamic and as a consequence the
> trust arrangement must be as well. Also, it
> doesn't seem entirely clear what the semantics are
> for the neessary binding updates from a mobile
> router -- I'm assuming that the BU's ought to come
> from the mobile router instead of the host behind
> the mobile router, 
> 
> => No the BU in MIPv6 MUST come from the MN. 
> There are no proxy or surrogate BUs in MIPv6. 
> 
> In HMIPv6 we proposed a solution for the mobile
> router case. Please have a look at the Extended
> mode in HMIPv6 and let us know if it doesn't 
> solve the problem. 
> 
> The only time I think the Mobile router should send
> a BU to cover the entire subnet is if the nodes 
> attached do not actually have a MN imlementation. 
> There is another draft by Thierry ernst and Claude
> Castelluccia and others to cover this case.
> Sorry I can't remember the full name but look
> under draft-ernst- ...
> 
>