Subject: RE: [mobile-ip] Security Problems with FBU (was: Re: [mipcharter] Proposed Charter for IPv6 Mobility)

From: "Mohamed Khalil" <[email-masked]>
Date: Wed, 5 Mar 2003 14:55:10 -0600

Hi Jim,

2) If the FBU message is sent when the MN is on the newAR, the newAR's
ingress filter will reject the message if the address is PCoA. The MN can't
use NCoA because it might not be configured yet. Other good properties if
ND-derived, on link signaling is used:
    
MK>> The ingress filter is a table which defines the range of addresses
which are allowed to be forwarded. The example rule as it is illustrated in
RFC 2827 is as follows
              
    IF    packet's source address from within 204.69.207.0/24
    THEN  forward as appropriate

    IF    packet's source address is anything else
    THEN  deny packet

The new AR can add an entry for the MN's pCOA to allow traffics carrying
such source IP address to be forwarded as normal.  So, the new table will
contains the following rules:
 
    IF packet's source address from within the MN's pCOA
    THEN forward as appropriate

    IF    packet's source address from within 204.69.207.0/24
    THEN  forward as appropriate

    IF    packet's source address is anything else
    THEN  deny packet

The addition of this rule is just programming issue.

-Mohamed

---

From: "James Kempf" <[email-masked]>
Date: Wed, 5 Mar 2003 13:28:14 -0800

How does the new AR know that the new address is an authorized MN and not some
attacker?

            jak

----- Original Message -----
From: "Mohamed Khalil" <[email-masked]>
To: "'James Kempf'" <[email-masked]>
Cc: <[email-masked]>; "Rajeev Koodli" <[email-masked]>
Sent: Wednesday, March 05, 2003 12:55 PM
Subject: RE: [mobile-ip] Security Problems with FBU (was: Re: [mipcharter]
Proposed Charter for IPv6 Mobility)