Subject: RE: [mobile-ip] FMIPv6: Sending FBU from the new link

From: "Mohamed Khalil" <[email-masked]>
Date: Tue, 11 Mar 2003 13:39:37 -0600

Hi Rajeev,

After thinking more about the new approach for sending FBU, I think this
approach might simplify the security model by eliminating the need to have a
SA between the MN and pAR. The new proposal will require to use a SA defined
by a protocol such as SEND to secure the FBU to the current AR. Then another
SA to secure the HI message encapsulating the FBU which is not difficult to
have if we assume that those ARs belongs to ISPs who have some sort of
service level agreement between each other.

-Mohamed
-----Original Message-----
From: Rajeev Koodli [mailto:[email-masked]] 
Sent: Tuesday, March 11, 2003 11:38 AM
To: Alper Yegin
Cc: [email-masked]
Subject: Re: [mobile-ip] FMIPv6: Sending FBU from the new link

Alper, Mohamed,

I agree that it is possible to selectively allow rate-limited FBUs. What
about routers beyond the new router ? Wouldn't we end up making additional
assumptions about them ? Could you also describe what is the additional
overhead introduced by terminating FBU at new AR and perhaps encapsulating
it in a HI ?

-Rajeev

Alper Yegin wrote:

> Hi Rajeev,
>
> I don''t think this is a good idea. This complicates the protocol 
> unnessarily. Allowing F-BU be sent from new link with oldCoA as the 
> source is a further enhancement or failure recovery to the base FMIP 
> protocol. I think it is reasonable to expect the access network to 
> optionally allow some limited packets  be sent with topologically 
> incorrect source address for this "bonus point". These packets are 
> such that they must be F-BU sent by an already authenticated MN, 
> source address must be from a prefix in the access network, 
> destination address can only be another AR in this network. And if the 
> AR cares, it can log them in case this mechanism is ever abused. This 
> is not like opening an access network's ingress filtering, or 
> completely disabling ingress filtering on the Internet.
>
> So, imho, we shouldn't have to complicate the protocol by doing either 
> of what you suggested below.
>
> alper
>
> > Hello folks,
> >
> > I would like to follow up on the following e-mail. Specifically, I 
> > think it would be better to have FBU terminate at the new AR, and 
> > let the new AR send HI with the binding authorization from the MN 
> > (item 2) below). Perhaps encapsulate FBU in HI..
> > That way, the FBU won't have to be forwarded
> > with topologically inconsistent source IP address,
> > potentially across multiple hops.
> >
> > Regards,
> >
> > -Rajeev
> >
> >
> >
> > -------- Original Message --------
> > Subject: Re: [mobile-ip] Security Problems with FBU (was: Re: 
> > [mipcharter] Proposed Charter for IPv6 Mobility)
> > Date: Wed, 05 Mar 2003 17:52:46 -0800
> > From: Rajeev Koodli <[email-masked]>
> > Organization: Nokia Research Center
> > To: James Kempf <[email-masked]>
> > CC: Mohamed Khalil <[email-masked]>, 
> > [email-masked]
> > References: 
> > <[email-masked]>
> > <025001c2e365$4b2eb730$156015ac@T23KEMPF>
> >
> > I see two possible ways to handle this.
> >
> > 1) rate limit the FBUs sent from new link
> > 2) allow NAR to send HI, as Jim has suggested, but include the
> >    binding authorization from the MN in HI.
> >
> > -Rajeev
> >
> >
> > James Kempf wrote:
> >
> >> If the MN sends the FBU message on the new AR, then the HI message 
> >> arrives at the new AR after the FBU is routed to the previous AR by 
> >> the new AR.
> >>
> >> Chicken and egg problem.
> >>
> >>             jak
> >>
> >> ----- Original Message -----
> >> From: "Mohamed Khalil" <[email-masked]>
> >> To: "'James Kempf'" <[email-masked]>
> >> Cc: <[email-masked]>; "Rajeev Koodli" 
> >> <[email-masked]>
> >> Sent: Wednesday, March 05, 2003 1:57 PM
> >> Subject: RE: [mobile-ip] Security Problems with FBU (was: Re:
[mipcharter]
> >> Proposed Charter for IPv6 Mobility)
> >>
> >>> The oAR is sending an HI message with the pCOA to the nAR. I am 
> >>> assuming that the HI will be sent securely to the nAR through some 
> >>> type of security protocol such as IPSec (the definition of this 
> >>> protocol is suppose to be outside the scope of this draft). This 
> >>> implies that the owner of this pCOA has been granted access to the 
> >>> old subnetwork and is not an attacker. When the nAR receives HI 
> >>> message it is suppose to verify this message and part of the 
> >>> functionality is to add an entry for the MN's pCOA to the ingress 
> >>> filter table. I agree that there are some more work to be done in 
> >>> the area of securing FBU and HI/HACK which should be addressed by 
> >>> other future drafts as Rajeev indicated before.
> >>>
> >>>
> >
> > [snip]
> >

---

From: Alper Yegin <[email-masked]>
Date: Tue, 11 Mar 2003 12:31:57 -0800

Hi MK,

However we are thinking that we can build an SA between MN and currentAR,
why
couldn¹t it help to build one between MN and oldAR when MN was there? It is
not
hard to think that we can use it 9at least for a while) after MN leaves the
link.

The state change is on the oldAR. Somehow oldAR needs to authorizes MN¹s
request to
change forwarding state. This is why I think they should be talking
directly.
Without getting some state from oldAR for this particular MN, currentAR
cannot
authorize, or suggest a change on the oldAR. oldAR needs to get some
credentials
specific to MN before it can authorize the change. This is best done when
they directly communicate. It is doable if we have to break the end2end
comm. into two: MN to currentAR, currentAR to oldAR, but not desirable.

alper

On 3/11/03 11:39 AM, "Mohamed Khalil" <[email-masked]> wrote:

> have if we assume that those ARs belongs to ISPs who have some sort of service
> level agreement between each other.
> 
> -Mohamed 
> I agree that it is possible to selectively allow rate-limited FBUs. What about
> routers beyond the new router ? Wouldn't we end up making additional
> overhead introduced by terminating FBU at new AR and perhaps encapsulating it
> in a HI ?
> 
> -Rajeev 
> 
> 
> Alper Yegin wrote:
> 
>> > Hi Rajeev, 
>> >

---

From: Rajeev Koodli <[email-masked]>
Date: Tue, 11 Mar 2003 12:40:08 -0800

Mohamed Khalil wrote:

>
>
> Hi Rajeev,
>
> After thinking more about the new approach for sending FBU, I think
> this approach might simplify the security model by eliminating the
> need to have a SA between the MN and pAR. The new proposal will
> require to use a SA defined by a protocol such as SEND to secure the
> FBU to the current AR.

First, I am not implying tying the protocol to SEND or any other
protocol.
Of course, I would like to re-use what exists and if majority of the
folks want
it.

And, the MN must have established the SA with PAR in the first place,
right ?
You would need that in order to authorize PAR to redirect traffic. This
is the
basic model we have: a MN authorizes a node on its previous point of
attachment
to redirect its own traffic. If this model itself needs to be
questioned, something
that deserves consideration, I suggest some place else for that.
I cannot progress the
draft if we can't even stick to the reason (if principle is an
over-loaded term) why
this is in Mobile IPv6.

-Rajeev

> Then another SA to secure the HI message encapsulating the FBU which
> is not difficult to have if we assume that those ARs belongs to ISPs
> who have some sort of service level agreement between each other.
>
> -Mohamed
> I agree that it is possible to selectively allow rate-limited FBUs.
> What about routers beyond the new router ? Wouldn't we end up making
> additional assumptions about them ? Could you also describe what is
> the additional overhead introduced by terminating FBU at new AR and
> perhaps encapsulating it in a HI ?
>
> -Rajeev
>
> Alper Yegin wrote:
>
> > Hi Rajeev,
> >