Mobile Communications Mobility Support in Network Layer

Transcription

1 Motivation Mobility support needed to be able to use mobile devices in the Mobile devices need IP address for their communication Applications would like to communicate while being on the move Mobile Communications Mobility Support in Network Layer DHCP Mobile IP DHCP Original design motivation was not so much mobility support BUT: DHCP is very important today to use mobile device like laptop in a environment Enables integration of device into Mobile IP Enables reachability of a device, using a specific, known IP address Provides for transparency above IP, i.e. also to support ongoing TCP connections Mobile Communications Mobility Support in Network Layer 1 Mobile Communications Mobility Support in Network Layer 2 DHCP: Dynamic Host Configuration Protocol DHCP - protocol mechanisms Application simplification of installation and maintenance of ed computers Dynamic assignment of IP address supplies systems with all necessary information, such as IP address, DNS server address, domain name, subnet mask, default etc. enables automatic integration of systems into an Intranet or the, can be used to acquire an address for Mobile IP Client/Server-Model the client sends via broadcast a request () to find a DHCP server server (not selected) determine the configuration DHCPOFFER DHCPREQUEST (reject) client initialization collection of replies DHCPOFFER selection of configuration DHCPREQUEST (options) DHCPACK server (selected) determine the configuration confirmation of configuration initialization completed client server client release DHCPRELEASE delete context Mobile Communications Mobility Support in Network Layer 3 Mobile Communications Mobility Support in Network Layer 4

2 DHCP: Discovery via Relay not in all subnets a separate DHCP server helps to reduce number servers then in a subnet a relay agent is needed, this knows DHCP server in a neighboring subnet relay forwards (as unicast) request to DHCP server Server DHCP characteristics several servers can be configured for DHCP, coordination not yet standardized (i.e., manual configuration) Addresses: DHCP can assign always the same IP address to a client Or a clients gets a dynamically selected IP address from a certain range (broadcast) (unicast) Options available for s, subnet mask, NTP ( time protocol) timeserver, SLP (service location protocol) directory, DNS (domain name system) client relay server Big security problems! no authentication of DHCP information specified Mobile Communications Mobility Support in Network Layer 5 Mobile Communications Mobility Support in Network Layer 6 DHCP Lease IP addresses are assigned for a limited time ( lease ) Allows for reuse even if mobile device does not perform explicit disconnect Lease has to be renewed if IP address is needed for longer time DHCP Security Concerns Basic questions: Is client trustworthy? Is server / trustworthy? Client is informed about lease value plus two times T1 and T2 T1=50% of lease time T2=87,5% of lease time After T1, client tries to renew lease Send new request (DHCPREQUEST) to DHCP server which gave it the lease At T2, if no positive response has been received by the client new broadcast to all DHCP servers () as at the beginning Network wrt Client Devices in a sub have often certain privileges Should not be given to unknown guest device Client may request many IP addresses Client wrt / DHCP server Server may provide spurious configuration data Is server potentially doing a man in the middle attack? Authentication of DHCP information should be performed But often missing Mobile Communications Mobility Support in Network Layer 7 Mobile Communications Mobility Support in Network Layer 8

3 Motivation for Mobile IP Requirements to Mobile IP (RFC 3344, was: 3220, was: 2002) Routing based on IP destination address, prefix (e.g ) determines physical subnet change of physical subnet implies change of IP address to have a topological correct address (standard IP) or needs special entries in the routing tables Specific routes to end-systems? change of all routing table entries to forward packets to the right destination does not scale with the number of mobile hosts and frequent changes in the location, security problems Changing the IP-address? adjust the host IP address depending on the current location almost impossible to find a mobile system, DNS updates take to long time TCP connections break, security problems Transparency mobile end-systems keep their IP address continuation of communication after interruption of link possible point of connection to the fixed can be changed Compatibility support of the same layer 2 protocols as IP no changes to current end-systems and s required mobile end-systems can communicate with fixed systems Security authentication of all registration messages Efficiency and scalability only little additional messages to the mobile system required (connection typically via a low bandwidth radio link) world-wide support of a large number of mobile systems in the whole Mobile Communications Mobility Support in Network Layer 9 Mobile Communications Mobility Support in Network Layer 10 Terminology Example Mobile Node () system (node) that can change the point of connection to the without changing its IP address Home Agent () system in the home of the, typically a registers the location of the, tunnels IP datagrams to the COA Foreign Agent () system in the current of the, typically a forwards the tunneled datagrams to the, typically also the default for the Care-of Address (COA) address of the current tunnel end-point for the (at or ) actual location of the from an IP point of view can be chosen, e.g., via DHCP Correspondent Node () communication partner home (physical home for the ) end-system mobile end-system (current physical for the ) Mobile Communications Mobility Support in Network Layer 11 Mobile Communications Mobility Support in Network Layer 12

4 transfer to the mobile system transfer from the mobile system 2 1 home 3 receiver home sender sender 1 1. Sender sends to the IP address of, intercepts packet (proxy ARP) 2. tunnels packet to COA, here, by encapsulation 3. forwards the packet to the receiver 1. Sender sends to the IP address of the receiver as usual, works as default Mobile Communications Mobility Support in Network Layer 13 Mobile Communications Mobility Support in Network Layer 14 Overview Network integration COA Agent Advertisement home and periodically send advertisement messages into their physical subnets listens to these messages and detects, if it is in the home or a (standard case for home ) reads a COA from the advertisement messages Registration (always limited lifetime!) home signals COA to the via the, acknowledges via to these actions have to be secured by authentication Advertisement advertises the IP address of the (as for fixed systems), i.e. standard routing information s adjust their entries, these are stable for a longer time ( responsible for a over a longer period of time) packets to the are sent to the, independent of changes in COA/ Mobile Communications Mobility Support in Network Layer 15 Mobile Communications Mobility Support in Network Layer 16

5 Agent advertisement Registration type code checksum #addresses addr. size lifetime address 1 preference level 1 address 2 preference level 2... type = 16 = * #COAs type = 16 R: registration required B: busy, no more registrations H: home agent F: agent M: minimal encapsulation G: GRE encapsulation r: =0, ignored (former Van Jacobson compression) T: supports reverse tunneling reserved: =0, ignored registration lifetime sequence number R B H F M G r T reserved COA 1 COA 2... t t Mobile Communications Mobility Support in Network Layer 17 Mobile Communications Mobility Support in Network Layer 18 Mobile IP registration request Mobile IP registration reply S: simultaneous bindings B: broadcast datagrams D: decapsulation by M mininal encapsulation G: GRE encapsulation r: =0, ignored T: reverse tunneling requested x: =0, ignored type = 1 S B DMG r T x lifetime home address home agent COA identification extensions... Mobile Communications Mobility Support in Network Layer type = 3 code lifetime home address home agent identification Example codes: extensions... registration successful 0 registration accepted 1 registration accepted, but simultaneous mobility bindings unsupported registration denied by 65 administratively prohibited 66 insufficient resources 67 mobile node failed authentication 68 home agent failed authentication 69 requested Lifetime too long registration denied by 129 administratively prohibited 131 mobile node failed authentication 133 registration Identification mismatch 135 too many simultaneous mobility bindings Mobile Communications Mobility Support in Network Layer 20

6 Encapsulation original IP header original data new IP header new data outer header inner header original data Encapsulation I Encapsulation of one packet into another as payload e.g. IPv6 in IPv4 (6Bone), Multicast in Unicast (Mbone) here: e.g. IP-in-IP-encapsulation, minimal encapsulation or GRE (Generic Record Encapsulation) IP-in-IP-encapsulation (mandatory, RFC 2003) tunnel between and COA TTL IP-in-IP IP checksum IP address of Care-of address COA TTL lay. 4 prot. IP checksum IP address of IP address of TCP/UDP/... payload Mobile Communications Mobility Support in Network Layer 21 Mobile Communications Mobility Support in Network Layer 22 Encapsulation II Generic Routing Encapsulation Minimal encapsulation (optional) avoids repetition of identical fields e.g. TTL, IHL, version, DS (RFC 2474, old: TOS) only applicable for unfragmented packets, no space left for fragment identification RFC 1701 outer header new header GRE header original header original header new data original data original data TTL min. encap. IP checksum IP address of care-of address COA lay. 4 protoc. S reserved IP checksum IP address of original sender IP address (if S=1) TCP/UDP/... payload TTL GRE IP checksum IP address of Care-of address COA CR K S s rec. rsv. ver. protocol checksum (optional) offset (optional) key (optional) sequence number (optional) routing (optional) TTL lay. 4 prot. IP checksum IP address of IP address of C RFC 2784 reserved0 ver. checksum (optional) protocol reserved1 (=0) TCP/UDP/... payload Mobile Communications Mobility Support in Network Layer 23 Mobile Communications Mobility Support in Network Layer 24

7 Optimization of packet forwarding Change of agent Triangular Routing sender sends all packets via to higher latency and load Solutions sender learns the current location of direct tunneling to this location informs a sender about the location of big security problems! Change of packets on-the-fly during the change can be lost new informs old to avoid packet loss, old now forwards remaining packets to new this information also enables the old to release resources for the old new Update ACK Warning Request Update ACK Update ACK Registration changes location t Mobile Communications Mobility Support in Network Layer 25 Mobile Communications Mobility Support in Network Layer 26 Reverse tunneling (RFC 3024, was: 2344) Mobile IP with reverse tunneling home receiver sender 1. sends to 2. tunnels packets to by encapsulation 3. forwards the packet to the receiver (standard case) Router accept often only topological correct addresses (firewall!) a packet from the encapsulated by the is now topological correct furthermore multicast and TTL problems solved (TTL in the home correct, but is to far away from the receiver) Reverse tunneling does not solve problems with firewalls, the reverse tunnel can be abused to circumvent security mechanisms (tunnel hijacking) optimization of data paths, i.e. packets will be forwarded through the tunnel via the to a sender (double triangular routing) The standard is backwards compatible the extensions can be implemented easily and cooperate with current implementations without these extensions Agent Advertisements can carry requests for reverse tunneling Mobile Communications Mobility Support in Network Layer 27 Mobile Communications Mobility Support in Network Layer 28

8 Mobile IP and IPv6 Mobile IP was developed for IPv4, but IPv6 simplifies the protocols security is integrated and not an add-on, authentication of registration is included COA can be assigned via auto-configuration (DHCPv6 is one candidate), every node has address autoconfiguration no need for a separate, all s perform advertisement which can be used instead of the special agent advertisement; addresses are always co-located can signal a sender directly the COA, sending via not needed in this case (automatic path optimization) soft hand-over, i.e. without packet loss, between two subnets is supported sends the new COA to its old the old encapsulates all incoming packets for the and forwards them to the new COA authentication is always granted Security Problems with mobile IP authentication with problematic, for the typically belongs to another organization no protocol for key management and key distribution has been standardized in the patent and export restrictions Firewalls typically mobile IP cannot be used together with firewalls, special set-ups are needed (such as reverse tunneling) QoS many new reservations in case of RSVP tunneling makes it hard to give a flow of packets a special treatment needed for the QoS Mobile Communications Mobility Support in Network Layer 29 Mobile Communications Mobility Support in Network Layer 30 Mobile IP: Summary Solutions for mobility support like Mobile IP exist But due to complexity of methods and need for additional components not used widely Most clients do not provide services Obtaining IP address via DHCP is usually sufficient, e.g., for access, printer services etc. Mobile Communications Mobility Support in Network Layer 35