COSC : mobility within same subnet. Lecture 26. H1 remains in same IP subnet: IP address can remain same

Transcription

1 Lecture : mobility within same subnet H1 remains in same IP subnet: IP address can remain same switch: which AP is associated with H1? self learning (Ch. 5): switch will see frame from H1 and remember which switch port can be used to reach H1 BBS 1 H1 BBS

2 802.11: advanced capabilities Rate adaptation base station, mobile dynamically change transmission rate (physical layer modulation technique) as mobile moves, SNR varies QAM256 (8 Mbps) QAM16 (4 Mbps) BPSK (1 Mbps) operating point BER SNR(dB) 1. SNR decreases, BER increase as node moves away from base station 2. When BER becomes too high, switch to lower transmission rate but with lower BER : advanced capabilities power management node-to-ap: I am going to sleep until next beacon frame AP knows not to transmit frames to this node node wakes up before next beacon frame beacon frame: contains list of mobiles with APto-mobile frames waiting to be sent node will stay awake if AP-to-mobile frames to be sent; otherwise sleep again until next beacon frame 6-4 2

3 802.15: Personal Area Network less than 10 m diameter replacement for cables (mouse, keyboard, headphones) ad hoc: no infrastructure master/slaves: slaves request permission to send (to master) master grants requests : evolved from Bluetooth specification GHz radio band up to 721 kbps S M S P S P M P S P radius of coverage P Master device Slave device Parked device (inactive) 6-5 Chapter 6 outline 6.1 Introduction Wireless 6.2 Wireless links, characteristics CDMA 6.3 IEEE wireless LANs ( Wi Fi ) 6.4 Cellular Internet access architecture standards (e.g., GSM) Mobility 6.5 Principles: addressing and routing to mobile users 6.6 Mobile IP 6.7 Handling mobility in cellular s 6.8 Mobility and higher-layer protocols 6.9 Summary 6-6 3

4 Components of cellular architecture cell covers geographical region base station (BS) analogous to AP mobile users attach to through BS air-interface: physical and link layer protocol between mobile and BS connects cells to wired tel. net. manages call setup (more later!) handles mobility (more later!) Mobile Switching Center Mobile Switching Center Public telephone wired 6-7 Cellular s: the first hop Two techniques for sharing mobile-to-bs radio spectrum combined FDMA/TDMA: divide spectrum in frequency channels, divide each channel into time slots CDMA: code division multiple access frequency bands time slots 6-8 4

5 2G (voice) architecture Base station system (BSS) BTS BSC G Public telephone Gateway Legend Base transceiver station (BTS) Base station controller (BSC) Mobile Switching Center () Mobile subscribers 6-9 3G (voice+data) architecture radio controller G Public telephone Gateway Key insight: new cellular data operates in parallel (except at edge) with existing cellular voice voice unchanged in core data operates in parallel SGSN G GGSN Public Internet Serving GPRS Support Node (SGSN) Gateway GPRS Support Node (GGSN)

6 3G (voice+data) architecture radio controller G Public telephone Gateway SGSN G GGSN Public Internet radio interface (WCDMA, HSPA) radio access Universal Terrestrial Radio Access Network (UTRAN) core General Packet Radio Service (GPRS) Core Network public Internet 6-11 Chapter 6 outline 6.1 Introduction Wireless 6.2 Wireless links, characteristics CDMA 6.3 IEEE wireless LANs ( Wi Fi ) 6.4 Cellular Internet Access architecture standards (e.g., GSM) Mobility 6.5 Principles: addressing and routing to mobile users 6.6 Mobile IP 6.7 Handling mobility in cellular s 6.8 Mobility and higher-layer protocols 6.9 Summary

7 What is mobility? spectrum of mobility, from the perspective: no mobility high mobility mobile wireless user, using same access point mobile user, connecting/ disconnecting from using DHCP. mobile user, passing through multiple access point while maintaining ongoing connections (like cell phone) 6-13 Mobility: vocabulary home : permanent home of mobile (e.g., /24) home agent: entity that will perform mobility functions on behalf of mobile, when mobile is remote permanent address: address in home, can always be used to reach mobile e.g., wide area

8 Mobility: more vocabulary permanent address: remains constant (e.g., ) care-of-address: address in visited. (e.g., 79, ) visited : in which mobile currently resides (e.g., /24) correspondent: wants to communicate with mobile wide area foreign agent: entity in visited that performs mobility functions on behalf of mobile How do you contact a mobile friend: Consider friend frequently changing addresses, how do you find her? search all phone books? call her parents? expect her to let you know where he/she is? I wonder where Alice moved to?

9 Mobility: approaches let routing handle it: routers advertise permanent address of mobile-nodes-in-residence via usual routing table exchange. routing tables indicate where each mobile located no changes to end-systems let end-systems handle it: indirect routing: communication from correspondent to mobile goes through home agent, then forwarded to remote direct routing: correspondent gets foreign address of mobile, sends directly to mobile 6-17 Mobility: approaches let routing handle it: routers advertise permanent address of mobile-nodes-in-residence not via usual scalable routing table exchange. to millions of routing tables indicate mobileswhere each mobile located no changes to end-systems let end-systems handle it: indirect routing: communication from correspondent to mobile goes through home agent, then forwarded to remote direct routing: correspondent gets foreign address of mobile, sends directly to mobile

10 Mobility: registration home visited wide area foreign agent contacts home agent home: this mobile is resident in my 2 1 mobile contacts foreign agent on entering visited end result: foreign agent knows about mobile home agent knows location of mobile 6-19 Mobility via indirect routing home home agent intercepts packets, forwards to foreign agent foreign agent receives packets, forwards to mobile 3 visited correspondent addresses packets using home address of mobile 1 wide area 2 4 mobile replies directly to correspondent

11 Indirect Routing: comments mobile uses two addresses: permanent address: used by correspondent (hence mobile location is transparent to correspondent) care-of-address: used by home agent to forward datagrams to mobile foreign agent functions may be done by mobile itself triangle routing: correspondent-home-mobile inefficient when correspondent, mobile are in same 6-21 Indirect routing: moving between s suppose mobile user moves to another registers with new foreign agent new foreign agent registers with home agent home agent update care-of-address for mobile packets continue to be forwarded to mobile (but with new care-of-address) mobility, changing foreign s transparent: on going connections can be maintained!

12 Mobility via direct routing home correspondent forwards to foreign agent foreign agent receives packets, forwards to mobile visited correspondent requests, receives foreign address of mobile mobile replies directly to correspondent 6-23 Mobility via direct routing: comments overcome triangle routing problem non-transparent to correspondent: correspondent must get care-of-address from home agent what if mobile changes visited?

13 Accommodating mobility with direct routing anchor foreign agent: FA in first visited data always routed first to anchor FA when mobile moves: new FA arranges to have data forwarded from old FA (chaining) correspondent wide area 1 correspondent agent anchor foreign agent new foreign agent foreign net visited at session start 2 new foreign 6-25 Chapter 6 outline 6.1 Introduction Wireless 6.2 Wireless links, characteristics CDMA 6.3 IEEE wireless LANs ( Wi Fi ) 6.4 Cellular Internet Access architecture standards (e.g., GSM) Mobility 6.5 Principles: addressing and routing to mobile users 6.6 Mobile IP 6.7 Handling mobility in cellular s 6.8 Mobility and higher-layer protocols 6.9 Summary

14 Mobile IP RFC 3344 has many features we ve seen: home agents, foreign agents, foreign agent registration, care of addresses, encapsulation (packet within a packet) three components to standard: indirect routing of datagrams agent discovery registration with home agent 6-27 Mobile IP: indirect routing foreign-agent-to-mobile packet packet sent by home agent to foreign agent: a packet within a packet dest: dest: dest: Permanent address: dest: packet sent by correspondent Care-of address:

15 Mobile IP: agent discovery agent advertisement: foreign/home agents advertise service by broadcasting ICMP messages (typefield = 9) type = 9 code = 0 checksum H,F bits: home and/or foreign agent router address standard ICMP fields R bit: registration required type = 16 length sequence # RBHFMGV registration lifetime reserved bits 0 or more care-ofaddresses mobility agent advertisement extension 6-29 Mobile IP: registration example home agent HA: registration req. COA: HA: MA: Lifetime: 9999 identification: 714 encapsulation format. registration reply HA: MA: Lifetime: 4999 Identification: 714 encapsulation format. time visited : /24 foreign agent COA: ICMP agent adv. COA: registration req. COA: HA: MA: Lifetime: 9999 identification:714. registration reply HA: MA: Lifetime: 4999 Identification: 714. mobile agent MA:

16 Components of cellular architecture recall: wired public telephone correspondent different cellular s, operated by different providers 6-31 Handling mobility in cellular s home : of cellular provider you subscribe to (e.g., Sprint PCS, Verizon) home location register (HLR): database in home containing permanent cell phone #, profile information (services, preferences, billing), information about current location (could be in another ) visited : in which mobile currently resides visitor location register (VLR): database with entry for each user currently in could be home

17 GSM: indirect routing to mobile home consults HLR, gets roaming number of mobile in visited mobile user HLR 2 home home Mobile Switching Center VLR Mobile Switching Center 4 visited 3 correspondent 1 call routed to home Public switched telephone home sets up 2 nd leg of call to in visited in visited completes call through base station to mobile 6-33 GSM: handoff with common old BSS VLR Mobile Switching Center old routing new routing new BSS handoff goal: route call via new base station (without interruption) reasons for handoff: stronger signal to/from new BSS (continuing connectivity, less battery drain) load balance: free up channel in current BSS GSM doesnt mandate why to perform handoff (policy), only how (mechanism) handoff initiated by old BSS

18 GSM: handoff with common old BSS VLR Mobile Switching Center new BSS 1. old BSS informs of impending handoff, provides list of 1 + new BSSs 2. sets up path (allocates resources) to new BSS 3. new BSS allocates radio channel for use by mobile 4. new BSS signals, old BSS: ready 5. old BSS tells mobile: perform handoff to new BSS 6. mobile, new BSS signal to activate new channel 7. mobile signals via new BSS to : handoff complete. reroutes call 8 -old-bss resources released 6-35 GSM: handoff between s home Home anchor correspondent PSTN (a) before handoff anchor : first visited during call call remains routed through anchor new s add on to end of chain as mobile moves to new optional path minimization step to shorten multi- chain

19 GSM: handoff between s home Home anchor correspondent PSTN (b) after handoff anchor : first visited during call call remains routed through anchor new s add on to end of chain as mobile moves to new optional path minimization step to shorten multi- chain 6-37 Mobility: GSM versus Mobile IP GSM element Comment on GSM element Mobile IP element Home system Gateway Mobile Switching Center, or home. Home Location Register (HLR) Visited System Visited Mobile services Switching Center. Visitor Location Record (VLR) Mobile Station Roaming Number (MSRN), or roaming number Network to which mobile user s permanent phone number belongs Home : point of contact to obtain routable address of mobile user. HLR: database in home system containing permanent phone number, profile information, current location of mobile user, subscription information Network other than home system where mobile user is currently residing Visited : responsible for setting up calls to/from mobile nodes in cells associated with. VLR: temporary database entry in visited system, containing subscription information for each visiting mobile user Routable address for telephone call segment between home and visited, visible to neither the mobile nor the correspondent. Home Home agent Visited Foreign agent Care-ofaddress

20 Wireless, mobility: impact on higher layer protocols logically, impact should be minimal best effort service model remains unchanged TCP and UDP can (and do) run over wireless, mobile but performance wise: packet loss/delay due to bit errors (discarded packets, delays for link layer retransmissions), and handoff TCP interprets loss as congestion, will decrease congestion window un necessarily delay impairments for real time traffic limited bandwidth of wireless links 6-39 Chapter 6 summary Wireless wireless links: capacity, distance channel impairments CDMA IEEE ( Wi Fi ) CSMA/CA reflects wireless channel characteristics cellular access architecture standards (e.g., GSM, 3G, 4G LTE) Mobility principles: addressing, routing to mobile users home, visited s direct, indirect routing care-of-addresses case studies mobile IP mobility in GSM impact on higher-layer protocols

21 Chapter 8: Network Security Chapter goals: understand principles of security: cryptography and its many uses beyond confidentiality authentication message integrity security in practice: firewalls and intrusion detection systems security in application, transport,, link layers Chapter 8 roadmap 8.1 What is security? 8.2 Principles of cryptography 8.3 Message integrity, authentication 8.4 Securing e mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7 Securing wireless LANs 8.8 Operational security: firewalls and IDS 21

22 What is security? confidentiality: only sender, intended receiver should understand message contents sender encrypts message receiver decrypts message authentication: sender, receiver want to confirm identity of each other message integrity: sender, receiver want to ensure message not altered (in transit, or afterwards) without detection access and availability: services must be accessible and available to users Friends and enemies: Alice, Bob, Trudy well known in security world Bob, Alice (lovers!) want to communicate securely Trudy (intruder) may intercept, delete, add messages Alice channel data, control messages Bob data secure sender Secure receiver data Trudy 22

23 Who might Bob, Alice be? well, real life Bobs and Alices! Web browser/server for electronic transactions (e.g., on line purchases) on line banking client/server DNS servers routers exchanging routing table updates other examples? There are bad guys (and girls) out there! Q: What can a bad guy do? A: A lot! See section 1.6 eavesdrop: intercept messages actively insert messages into connection impersonation: can fake (spoof) source address in packet (or any field in packet) hijacking: take over ongoing connection by removing sender or receiver, inserting himself in place denial of service: prevent service from being used by others (e.g., by overloading resources) 23

24 Chapter 8 roadmap 8.1 What is security? 8.2 Principles of cryptography 8.3 Message integrity, authentication 8.4 Securing e mail 8.5 Securing TCP connections: SSL 8.6 Network layer security: IPsec 8.7 Securing wireless LANs 8.8 Operational security: firewalls and IDS The language of cryptography K A Alice s encryption key Bob s decryption K Bkey plaintext encryption algorithm ciphertext decryption algorithm plaintext m plaintext message K A (m) ciphertext, encrypted with key K A m = K B (K A (m)) 24

25 Simple encryption scheme substitution cipher: substituting one thing for another monoalphabetic cipher: substitute one letter for another plaintext: abcdefghijklmnopqrstuvwxyz ciphertext: mnbvcxzasdfghjklpoiuytrewq e.g.: Plaintext: bob. i love you. alice ciphertext: nkn. s gktc wky. mgsbc Encryption key: mapping from set of 26 letters to set of 26 letters A more sophisticated encryption approach n substitution ciphers, M 1,M 2,,M n cycling pattern: e.g., n=4: M 1,M 3,M 4,M 3,M 2 ; M 1,M 3,M 4,M 3,M 2 ;.. for each new plaintext symbol, use subsequent subsitution pattern in cyclic pattern dog: d from M 1, o from M 3, g from M 4 Encryption key: n substitution ciphers, and cyclic pattern key need not be just n bit pattern 25

26 Breaking an encryption scheme cipher text only attack: Trudy has ciphertext she can analyze two approaches: brute force: search through all keys statistical analysis known plaintext attack: Trudy has plaintext corresponding to ciphertext e.g., in monoalphabetic cipher, Trudy determines pairings for a,l,i,c,e,b,o, chosen plaintext attack: Trudy can get ciphertext for chosen plaintext Types of Cryptography Crypto often uses keys: Algorithm is known to everyone Only keys are secret Public key cryptography Involves the use of two keys Symmetric key cryptography Involves the use one key Hash functions Involves the use of no keys Nothing secret: How can this be useful? 26

27 Symmetric key cryptography K S K S plaintext message, m encryption algorithm ciphertext K S (m) decryption algorithm plaintext m = K S (K S (m)) symmetric key crypto: Bob and Alice share same (symmetric) key: K S e.g., key is knowing substitution pattern in mono alphabetic substitution cipher Q: how do Bob and Alice agree on key value? Public Key Cryptography symmetric key crypto requires sender, receiver know shared secret key Q: how to agree on key in first place (particularly if never met )? public key crypto radically different approach [Diffie- Hellman76, RSA78] sender, receiver do not share secret key public encryption key known to all private decryption key known only to receiver 27

28 Public key cryptography K B + K B - Bob s public key Bob s private key plaintext message, m encryption algorithm ciphertext + K (m) B decryption algorithm plaintext message - + m = K (K (m)) B B Public key encryption algorithms requirements: B B - + K (K (m)) = m B B need K ( ) and K ( ) such that + given public key K B, it should be impossible to compute private - key K B RSA: Rivest, Shamir, Adelson algorithm 28

29 Prerequisite: modular arithmetic x mod n = remainder of x when divide by n facts: [(a mod n) + (b mod n)] mod n = (a+b) mod n [(a mod n) (b mod n)] mod n = (a b) mod n [(a mod n) * (b mod n)] mod n = (a*b) mod n thus (a mod n) d mod n = a d mod n example: x=14, n=10, d=2: (x mod n) d mod n = 4 2 mod 10 = 6 x d = 14 2 = 196 x d mod 10 = 6 RSA: getting ready message: just a bit pattern bit pattern can be uniquely represented by an integer number thus, encrypting a message is equivalent to encrypting a number. example: m= This message is uniquely represented by the decimal number 145. to encrypt m, we encrypt the corresponding number, which gives a new number (the ciphertext). 29

30 RSA: Creating public/private key pair 1. choose two large prime numbers p, q. (e.g., 1024 bits each) 2. compute n = pq, z = (p-1)(q-1) 3. choose e (with e<n) that has no common factors with z (e, z are relatively prime ). 4. choose d such that ed-1 is exactly divisible by z. (in other words: ed mod z = 1 ). 5. public key is (n,e). private key is (n,d). K B + K B - RSA: encryption, decryption 0. given (n,e) and (n,d) as computed above 1. to encrypt message m (<n), compute c = m e mod n 2. to decrypt received bit pattern, c, compute m = c d mod n magic happens! m = (m e mod n) c d mod n 30