Subject: [netlmm] Text about compromised MAG

From: "Kilian Weniger" <[email-masked]>
Date: Wed, 29 Aug 2007 10:45:11 +0200

Hi Sri,

I just came across the text about a compromised MAG in the security
considerations section of the current draft:

   "A compromised mobile access gateway can potentially send Proxy
   Binding Update messages on behalf of the mobile nodes that are not
   attached to its access link.  This threat is similar to an attack on
   a typical routing protocol or equivalent to the compromise of an on-
   path router.  This threat exists in the network today and this
   specification does not make this vulnerability any worse than what it
   is.  However, to eliminate this vulnerability, the local mobility
   anchor before accepting Proxy Binding Update message received from a
   mobile access gateway, MUST ensure the mobile node is attached to the
   mobile access gateway that sent the Proxy Binding Update message.
   This can be achieved using out of band mechanisms and the specifics
   of how that is achieved is beyond the scope of this document."

Since there is a "MUST" here, can we say "how that is achieved is beyond
the scope of this document"? Is it guaranteed that there is an
appropriate out of band mechanism available in every possible deployment
scenario? 

Also, we may need some text as a guidance for implementors: What are
required properties of such mechanism? What are examples for such out of
band mechanisms? I think AAA was mentioned as one possible mechanism,
but what are others? (as you know, the draft doesn't mandate AAA. Also,
AAA may not always achieve this, e.g., in a deployment scenario with
context transfer/fast re-auth). 

Regards,

Kilian

--------------------------------------------
Dr. Kilian Weniger
Panasonic R&D Center Germany
Monzastr. 4c, 63225 Langen, Germany
phone:  +49 (0)6103 766 137
fax:    +49 (0)6103 766 166
e-mail: [email-masked]
--------------------------------------------

Panasonic R&D Center Germany GmbH
63225 Langen, Hessen, Germany
Reg: AG Offenbach (Hessen) HRB 33974
Managing Director: Thomas Micke

_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

---

From: "Jong-Hyouk Lee" <[email-masked]>
Date: Wed, 29 Aug 2007 19:38:31 +0900

Dear colleague.

We can use the IKE mechanism to exchange keys for enabling IPsec. Only the
PBU message of satisfied MAGs with LMA through PAD (Peer Authorization
Database) and SPD (Security Policy Database) is accepted. The relationship
between LMA and its MAGs is the same to the wired network environments. So,
we can use the previous mechanisms used in the wired network environments.

Cheers.

-- 
Internet Management Technology Lab, Sungkyunkwan University.
Jong-Hyouk Lee.

#email: jonghyouk (at) gmail (dot) com
#webpage: http://www.hurryon.org
_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

---

From: "Jong-Hyouk Lee" <[email-masked]>
Date: Wed, 29 Aug 2007 19:54:14 +0900

Hi, Kilian Weniger.

Please, see my opinitions about AAA mechanism.

> context transfer/fast re-auth).

As I know, AAA mechanism would be useful in the access networks. In other
words, AAA mechanism should be useful between MAG and MN for negotiation for
security methods and keys and the IKE mechanism should be useful in the core
network or inner network, the connection between LMA and MAG.

Cheers.

---

From: "Sri Gundavelli" <[email-masked]>
Date: Wed, 29 Aug 2007 05:39:28 -0700

Hi Kilian, 

> -----Original Message-----
> From: Kilian Weniger [mailto:[email-masked]] 
> Sent: Wednesday, August 29, 2007 1:45 AM
> To: Sri Gundavelli
> Cc: [email-masked]
> Subject: Text about compromised MAG
> 
> Hi Sri,
> 

Actually, we removed the MUST clause here and rewrote this section.
We are now just recommending that deployment apply some out of band
mechanims to ensure there is some reasonable trust that the mobile
node is still attached to a given MAG. 

> context transfer/fast re-auth). 

May be we can just provide AAA as the example. Not sure, if we should
go beyond this. May be leave it to the AAA interface document or the
CT, access auth docs. 

Sri

---

From: "Sri Gundavelli" <[email-masked]>
Date: Wed, 29 Aug 2007 07:28:53 -0700

Hi Jong-Hyouk,

  _____  

From: Jong-Hyouk Lee [mailto:[email-masked]] 
Sent: Wednesday, August 29, 2007 3:39 AM
To: Kilian Weniger
Cc: Sri Gundavelli; [email-masked]
Subject: Re: [netlmm] Text about compromised MAG

Dear colleague.

 
[Sri] Sure. The spec clealy requires the LMA to authorize the MAG for
sending proxy registration requests.
That  authorization check is required. This is in the section related to MAG
compromise and we are stating
the LMA can try to use out of band mechanisms to ensure the mobile node is
truely attached to a given 
MAG. How that is achieved, is out of scope for this spec.
 
Sri