Subject: RE: [Mip6] mip6-aaa frameworks

From: Gerardo Giaretta <[email-masked]>
Date: Wed, 16 Feb 2005 09:45:01 +0100

Hi Erik,

> 
> Alper Yegin wrote:
> > This is an attempt to enumerate possible MIP6-AAA 
> frameworks, and start
> > discussions on for which one(s) IETF shall pursue standardization. 
> 
> Good summary.
> 
> FWIW I think that framework 4 is the key one to standardize, 
> because it 
> allows the network access AAA being decoupled from the MIP6 AAA.
> 
> Not that it doesn't require that they be completely separate, 
> since the 
> same AAA backend and the same NAI (and perhaps even EAP 
> method) could be 
> used for the cases when the same identity is used for noth 
> the network 
> access and for MIP6. And AFAIK it is this backend 
> infrastructure concern 
> that is key for the operators.
>

I agree that framework 4 should be standardized.
draft-chakrabati-mip6-bmip-00 describes a solution based on this
framework that allows also dynamic HA discovery. I guess this draft
could be a good starting point. Since in this draft the HA acts as a EAP
pass-through authenticator, I think we should also investigate if
Diameter EAP application is suitable for the HA-AAA communication or we
need another draft specifying a new Diameter application or some new
MIPv6-specific AVPs.

However note that this approach is not optimized in case of Integrated
ASP: in this scenario, the MN needs to execute two EAP runs, one EAP for
network access authentication and the other EAP over IKEv2 and, as you
mention, the same AAA backend, the same NAI and even the same EAP method
could be used for these two cases. For this reason, I think that we
should standardize also an optimized approach in which AAA for network
access and AAA for mobility service are dependent and only one EAP
exchange needs to be executed. Note that here I'm not not advocating any
of the solutions proposed so far (e.g. EAP, PANA, Diameter, DHCP), I'm
only suggesting to have also an optimized solution that might be useful
to mobile operators that would like to deploy MIPv6 in an efficient way.

Regards,
--Gerardo

 
> I think that degree of separation is the right thing for an 
> IETF standard.
> 
>     Erik
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6
> 

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to
[email-masked]. Thank you
====================================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Junghoon Jee" <[email-masked]>
Date: Wed, 16 Feb 2005 18:26:19 +0900

Hello, Gerardo.

>could be a good starting point. 

The dynamic HA discovery is still an issue.
With my mind, adding security mechanism to the pre-existing DNS query may be a burden. 
I would like to wait to look over the next version of that draft.
With regards to the framework 4,
I am still not clear about what the mobility service is.
I think the mobility service is started when the MN bootstraps.
When does the mobility service end ?
MIPv6 also supports the RR. 
That means that the HA may not know how many packets were trasversed for the MN.
With related with this point, accounting processing in the AAA server can be an issue.
As i know, currently AAA accounting is processed for the network access service.
If we try to charge only for the mobility service, we need to clearly define what the mobility service is.

>to mobile operators that would like to deploy MIPv6 in an efficient way

This is a reason why I would like to think about the bootstrapping framework first.

Junghoon

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 16 Feb 2005 10:32:24 -0800

> need another draft specifying a new Diameter application or some new

Yes, it makes sense to investigate this.

> to mobile operators that would like to deploy MIPv6 in an efficient way.

The thing that is a bit hard for me to understand is whether and how a 
MN can cope with both the separate and integrated ones.

For instance, do we see there being a MN which will perform the 
integrated approach (if that is used by the access network) and fallback 
to use the separate approach? Or will there be completely separate MNs 
so that we don't need to worry about which to try first and the possible 
interaction between the two different schemes.

    Erik

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 16 Feb 2005 10:41:11 -0800

> With my mind, adding security mechanism to the pre-existing DNS query may be a burden. 

The need for confidentiality of the HAs IP address is hard for me to 
understand without understanding the threat model.

Suppose there is perfect confidentiality. An attacker wants to attack 
the HA, and the attacker controls a large number of zombies for DDoS 
attack. It is sufficient for somebody, who has paid $10 for a month or 
an hour of service, to disclose the HA's IP address to the attacker, and 
then the DDoS attack can be launched towards that IP address.
And for a large operator, the probability that one of their legitimate 
subscribers is infected with a zombie, is quite high when PCs might be 
the MN. Such a zombie could then share the IP address with the attacker.

The upshot is that I don't think the subscribers can be trusted to not 
share the HA's IP address, either intentionally or unwittingly.

    Erik

---

From: "Junghoon Jee" <[email-masked]>
Date: Thu, 17 Feb 2005 09:52:50 +0900

Hello Erik,
Please see my comments inline.

----- Original Message ----- 
From: "Erik Nordmark" <[email-masked]>
To: "Junghoon Jee" <[email-masked]>
Cc: "Gerardo Giaretta" <[email-masked]>; "Alper Yegin" <[email-masked]>; <[email-masked]>
Sent: Thursday, February 17, 2005 3:41 AM
Subject: Re: [Mip6] mip6-aaa frameworks

> understand without understanding the threat model.

Currently, my concern is about the integrity and replay protection for HA IP address.
Could we support this without requiring the security function in the pre-existing DNS servers ?
My answer is NO.
If my answer is correct, pre-existing DNS servers needs to be changed to support MIP6 bootstrapping.
I am not sure whethere this approach is right.

BTW, i don't agree to open up the chance of  revealing the HA IP address by putting this information
into the publicly available DNS server. Anyone can query the DNS server to get any other's HA address.
This increase the possibility of DoS attack. I know that this point is already mentioned in the bmip6 draft.
I am waiting their right solution for this.

I hope we don't draw back the dynamic HA assignment during MIP6 bootstraspping because we can not find right way to to this.
Any good idea ?

> the MN. Such a zombie could then share the IP address with the attacker.

About the confidentiality protection about HA address,
I talked with Jame through this mailing before.
With my mind, security issue that can be touched by the mobilty protocol 
should be confined to the issues that are raised by the mobility protocol itself.
System security issues like hacking of local system's critical information or
ill-intended inside attackers are out of scope when considring the MIP6 security.

My point is that,
When we create a bootrapping framework and solution,
we need to carefully design this not to raise new possible attacks.
I agree with you that there is no perfect securty.
But this feature can not be mis-understood that we don't need to think
about the security issues that are raised by adopting a new protocol or solution.

--Junghoon

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 16 Feb 2005 18:36:18 -0800

> I am not sure whethere this approach is right.

I have to disagree here. it is like getting any other server's address
through DNS. IMHO, the threat model is no different.

> I am waiting their right solution for this.

this might sound cliched, but you cannot achieve security through
obscurity. :)

Vijay

>>------------------------------------------------------------------------
>>

---

From: "Junghoon Jee" <[email-masked]>
Date: Thu, 17 Feb 2005 13:02:25 +0900

Hello Vijay.

> through DNS. IMHO, the threat model is no different.

draft-ietf-bootstrap-ps requires the integrity and replay protection of bootstrapping information.
What do you think about this ?

> this might sound cliched, but you cannot achieve security through
Please look at the Appendix A. of bmip draft.
Could you explain why you use the word 'cliched' and 'obscurity' without any detailed explanation ?
Wouldn't you want to keep the basic step because you think it is cliched ?

Junghoon

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 16 Feb 2005 22:56:44 -0800

> I am not sure whethere this approach is right.

Integrity and replay of expired information can be provided by DNSsec. 
So the operator of the DNS which has the records for the HA's IP 
addresses just needs to deploy DNSsec.

> into the publicly available DNS server. Anyone can query the DNS
server to get any other's HA address.

I'm confused because above you said you were concerned about integrity 
and replay protection (in response to my comment about confidentiality), 
and now you are talking about confidentiality.

> This increase the possibility of DoS attack. I know that this point
> is
already mentioned in the bmip6 draft.
> I hope we don't draw back the dynamic HA assignment during MIP6 bootstraspping because we can not find right way to to this.

Depends on the details of what the threats are, and whether they are 
realistic.
Is the only concern that non-subscribers shouldn't be able to find out 
the HAs IP address? Is it ok if non-subscribers can find out the /64 (or 
/48) prefix which contains one or more HAs?
Is there a concern about malicious subscribers?
Is there a concern about subscribers which might be infectived with 
malware which sends off the IP addresses of the HAs to some attackers?

Without understanding the above questions and having some idea about the 
answers it isn't possible to define any useful confidentiality for the 
HAs IP address.

> ill-intended inside attackers are out of scope when considring the MIP6 security.

But security doesn't work that way. Having a very good door lock on your 
house, and making sure that it is locked when you leave home, is no good 
if you leave the windows wide open; security is a systems issue.
That doesn't mean you need to solve all the security issues in the whole 
system, but I think it does mean that you need to understand how 
security works across the whole system.

    Erik

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 17 Feb 2005 00:11:57 -0800

> What do you think about this ?

the problem statement doesnt actually require this. it lists it
as a design goal. there is a slight difference. and I had
actually excluded MN acquiring the HA's address through DNS as
something outside the bootstrapping problem statement. something
that can be used readily today. note, that only HA's address is
obtained through DNS. not the HoA.

and as Erik pointed out, one can always use DNSSEC.

> Could you explain why you use the word 'cliched' and 'obscurity' without any detailed explanation ?

because you can't really hope to hide your HA address. that is just
not possible. most often, I find that an Operator's configuration
settings can be just obtained from the web. I dont see Cingular
trying to hide GPRS Access Points information. they publish it on
the web.

> Wouldn't you want to keep the basic step because you think it is cliched ?

please read further in the same paragraph.

>    The threat from DDoS
>    in this case is no larger than for any other widely known public
>    Internet server, such as a popular Web site or, indeed, a DNS server
>    for a top level domain.  Measures similar to those used by popular
>    Web site providers or DNS server operators can be deployed to
>    mitigate such attacks. 

Vijay

---

From: Alper Yegin <[email-masked]>
Date: Thu, 17 Feb 2005 00:46:07 -0800

> That means that the HA may not know how many packets were trasversed
for
> the MN.
> With related with this point, accounting processing in the AAA server
can
> be an issue.
> As i know, currently AAA accounting is processed for the network
access
> service.

MIP6 service is being provided by the HA when there is an active MIP6
binding cache entry for the MN. HA can keep track of forward and reverse
tunneled IP packets, received BU/HoTI/HoT messages. HA cannot do
anything about end2end signaling and data traffic between the MN and
CNs. That's not necessary either. Turning these accounting information
to billing is not a protocol concern.

Alper

---

From: "James Kempf" <[email-masked]>
Date: Thu, 17 Feb 2005 08:45:19 -0800

Junghoon,

> I am not sure whethere this approach is right.

Replay protection is provided by the DNS protocol itself, integrity
protection is provided by DNSSEC. No need to change the protocol. Please see
RFC 2535 and RFC 1035.

> I am waiting their right solution for this.

But anyone can sign up for a subscription at a mobility service provider,
get the address by EAPoL2 or even have it manually provisioned, then use the
address to attack the HA. The only difference is that someone must take the
time and effort to sign up for the subscription, but how much of a barrier
is that? There are other ways of preventing against DoS attack on the HA
that need to be deployed by a serious mobility service provider, a mobility
service provider can't depend on bootstrapping being able to hide the
address.

        jak

---

From: "Junghoon Jee" <[email-masked]>
Date: Mon, 21 Feb 2005 11:29:05 +0900

Hello Vijay, 

----- Original Message ----- 
From: "Vijay Devarapalli" <[email-masked]>
To: "Junghoon Jee" <[email-masked]>
Cc: "Erik Nordmark" <[email-masked]>; "Gerardo Giaretta" <[email-masked]>; "Alper Yegin" <[email-masked]>; <[email-masked]>
Sent: Thursday, February 17, 2005 5:11 PM
Subject: Re: [Mip6] mip6-aaa frameworks

> obtained through DNS. not the HoA.

If the problem statement doen't need to list up the requirements about MIP6 bootstrapping.
I would like to exclude the sentences that might confuse the readers of that document.
BTW, I agree with James' second idea ;
"The other possibility would be to separate the draft into two, one for the
problem statement and one for the requirements and functional architecture."

Yes, I know that only HA's address is obtained through DNS not the HoA.

> trying to hide GPRS Access Points information. they publish it on

Yes, as you said I am not sure whether we can hide HA address under considering 
the current standardized RFC 3775.
My point is that,
Current example of opening critical information to the public infra,
can not justify that we can follow the same approach.

> >    Web site providers or DNS server operators can be deployed to

I already know what they are saying about.
I think, you need to check the previous discussion between James and me.

--Junghoon