Subject: RE: [mobile-ip] Security Problems with FBU (was: Re: [mipcharter] Proposed Charter for IPv6 Mobility)

From: "Mohamed Khalil" <[email-masked]>
Date: Wed, 5 Mar 2003 15:57:19 -0600

The oAR is sending an HI message with the pCOA to the nAR. I am assuming
that the HI will be sent securely to the nAR through some type of security
protocol such as IPSec (the definition of this protocol is suppose to be
outside the scope of this draft). This implies that the owner of this pCOA
has been granted access to the old subnetwork and is not an attacker. When
the nAR receives HI message it is suppose to verify this message and part of
the functionality is to add an entry for the MN's pCOA to the ingress filter
table. I agree that there are some more work to be done in the area of
securing FBU and HI/HACK which should be addressed by other future drafts as
Rajeev indicated before.

I don't think it is difficult to assume that those ARs belongs to ISPs which
have some level of roaming agreement and accordingly the ARs can have secure
communication using some security protocol like IPSec. 

-Mohamed
-----Original Message-----
From: James Kempf [mailto:[email-masked]] 
Sent: Wednesday, March 05, 2003 3:28 PM
To: Khalil, Mohamed [RICH2:2N51:EXCH]
Cc: [email-masked]; Rajeev Koodli
Subject: Re: [mobile-ip] Security Problems with FBU (was: Re: [mipcharter]
Proposed Charter for IPv6 Mobility)

How does the new AR know that the new address is an authorized MN and not
some attacker?

            jak

----- Original Message -----
From: "Mohamed Khalil" <[email-masked]>
To: "'James Kempf'" <[email-masked]>
Cc: <[email-masked]>; "Rajeev Koodli" <[email-masked]>
Sent: Wednesday, March 05, 2003 12:55 PM
Subject: RE: [mobile-ip] Security Problems with FBU (was: Re: [mipcharter]
Proposed Charter for IPv6 Mobility)

> Hi Jim,
>
>
> 2) If the FBU message is sent when the MN is on the newAR, the newAR's 
> ingress filter will reject the message if the address is PCoA. The MN 
> can't use NCoA because it might not be configured yet. Other good 
> properties if ND-derived, on link signaling is used:
>
> MK>> The ingress filter is a table which defines the range of 
> MK>> addresses
> which are allowed to be forwarded. The example rule as it is 
> illustrated in RFC 2827 is as follows
>
>     IF    packet's source address from within 204.69.207.0/24
>     THEN  forward as appropriate
>
>     IF    packet's source address is anything else
>     THEN  deny packet
>
> The new AR can add an entry for the MN's pCOA to allow traffics 
> carrying such source IP address to be forwarded as normal.  So, the 
> new table will contains the following rules:
>
>     IF packet's source address from within the MN's pCOA
>     THEN forward as appropriate
>
>     IF    packet's source address from within 204.69.207.0/24
>     THEN  forward as appropriate
>
>     IF    packet's source address is anything else
>     THEN  deny packet
>
> The addition of this rule is just programming issue.
>
> -Mohamed
>
>

---

From: "James Kempf" <[email-masked]>
Date: Wed, 5 Mar 2003 14:19:31 -0800

If the MN sends the FBU message on the new AR, then the HI message arrives at
the new AR after the FBU is routed to the previous AR by the new AR.

Chicken and egg problem.

            jak

---

From: Rajeev Koodli <[email-masked]>
Date: Wed, 05 Mar 2003 17:52:46 -0800

I see two possible ways to handle this.

1) rate limit the FBUs sent from new link
2) allow NAR to send HI, as Jim has suggested, but include the
     binding authorization from the MN in HI.

-Rajeev