internet goes mobile

Internet Goes Mobile

Alper Yegin

KIOW 2003 at APNIC 16August 19th, 2003. Seoul, Korea

2

Internet - Yesterday

Internet

DSL

Home Network

Dial up

Home user

T1Enterprise Network

3

Internet - Today and Tomorrow

Internet

DSL

Home Network

DSL

Home NetworkMobile Network

GPRSDial up

Home user

W-CDMA

T1Enterprise Network Operator NetworkCommunity Network

PAN

4

Challenge

• Users expect the same characteristics (greedy!)– Secure– Reliable– Seamless– High performance

• Burden is on:– Standards bodies (IETF, IEEE, 3GPP, 3GPP2, etc.)– Vendors– Operators

5

Security

• First things first!• Physical security is replaced with crypto-

based security– Threats: Eavesdropping, spoofing– Not a full replacement!

• Crypto designs and experts get a good exercise!

6

Solutions

• Good solutions:– 3GPP, 3GPP2

• Bad solutions– IEEE WEP fiasco!

• Practical but less than adequate solutions:– WECA WISPer: HTTP redirect and web-based login

hackery• Practical and reasonable solutions:

– IEEE 802.11b access outside VPN gateway

7

The Right Solution• Authenticate, authorize the client• Accounting and privacy

Home Network

Visited Network

host

AP

AccessRouter

HomeAAA ISP

AAA

PANA, 802.1X

Diameter, RADIUS

Diameter, RADIUS

8

The Right Solution• IETF AAA, EAP, and PANA Working Groups• IEEE 802.11i, 802.1aa

Home Network

Visited Network

host

AP

AccessRouter

HomeAAA ISP

AAA

PANA, 802.1X

Diameter, RADIUS

Diameter, RADIUS

9

Global AAA

• AAA web of trust is here (unlike global PKI) and more capable.

Home Network

Visited Network

AAAserver

AAAserver

Visited Network

AAAserver

Home Network

AAAserver

AAAbroker

AAAbroker

10

Impact• Security is never plug-and-play (plug-and-get-hacked!)• Additional infrastructure

– Front-end AAA servers (NAS)– Backend AAA servers (RADIUS, Diameter servers)– VPN gateways

• Configuration– On the clients– Per-client configuration on the servers (keys, authorization

parameters, etc.) – Configuration to join the AAA web-of trust

11

Impact

• Increased popularity of IPsec and TLS– AAA requires confidential information exchange– VPN– Anonymizer.com

• Strengthening internal network is a MUST– Unless you are 100% sure that wireless access is secure– Partitioning, IDS, enforcing strict policy execution

(social aspects)

12

But Still

• …. You are vulnerable to attacks!

• Price of going wireless

13

Mobility Management

• Host at home (fixed Internet).

Home Network

Visited Network

Web server

hosta::1

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

a::/64

AP

14

Mobility Management

• You move, you break!

Home Network

Visited Network

Web server

AP

AP APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

hostb::1

b::/64

15

Mobile IP

• IETF Mobile IP Working Group– www.ietf.org/html.charters/mobileip-charter.html

Home Network

Visited Network

Web server

hostb::1

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

HomeAgent

APb::/64

a::1b::1

homeaddress

care-ofaddress

16

Mobile IP

• Traffic tunneled through home network

Home Network

Visited Network

Web server

hostb::1

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

HomeAgent

APb::/64

17

Mobile IP

• End-to-end signaling for route optimization

Home Network

Visited Network

Web server

hostb::1

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

HomeAgent

APb::/64

a::1b::1

homeaddress

care-ofaddress

18

Mobile IP

• Most direct path for data traffic.

Home Network

Visited Network

Web server

hostb::1

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

HomeAgent

APb::/64

19

… Fast and Smooth

• Problem: Signaling latency.

Home Network

Visited Network

Web server

hostc::1

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

HomeAgent

APc::/64

a::1c::1

new care-ofaddress

20

… Fast and Smooth• Fast Handovers

– draft-ietf-mobileip-fast-mipv6-06.txt

• IETF Seamoby Working Group– www.ietf.org/html.charters/seamoby-charter.html

Home Network

Visited Network

Web server

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

HomeAgent

APc::/64b::1c::1

hostc::1

old care-ofaddress new care-of

address

21

… Fast and Smooth• Context transferred and routes fixed.

Home Network

Visited Network

Web server

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

HomeAgent

APc::/64

hostc::1

22

… Privacy

• Hide precise location and movement.

Home Network

Visited Network

Web server

hostd::1

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

HomeAgent

APd::/64

c::/64b::/64

cafeteria CEO’s office employee office

23

… Privacy

• Obtain an IP address from the localized mobility agent.

Home Network

Visited Network

Web server

hostd::1

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

HomeAgent

APd::/64

c::/64b::/64

LocalizedMobility Agent

e::1d::1

e::/64 a::1e::1

regionalcare-ofaddress

localcare-ofaddress

homeaddress

24

… Privacy

• Correspondent sends packets directly to the agent. Agent tunnels them to the precise location.

Home Network

Visited Network

Web server

hostd::1

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

HomeAgent

APd::/64

c::/64b::/64

LocalizedMobility Agent

25

… Privacy

• Correspondent does not know the real IP destination, or when it changes.

Home Network

Visited Network

Web server

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

HomeAgent

APc::/64b::/64

LocalizedMobility Agent

hostb::1

26

… AAA

• Mobility management is a for-profit “service”

Home Network

Visited Network

Web server

AP

APAP

AccessRouter

AccessRouter

AccessRouter

AccessRouter

HomeAgent

APc::/64b::/64

LocalizedMobility Agent

hostb::1

HomeAAA ISP

AAA

27

… Network is Mobile

• IETF NEMO Working Group– www.ietf.org/html.charters/nemo-charter.html

Visited NetworkAccessRouter

AccessRouter

AccessRouter

BaseStation

BaseStation

BaseStation

28

Impact on Intranet

• More stateful servers– Home agents, access routers (for context transfer and

fast handovers), localized mobility agents– Mobile IP bindings, tunnels, host-routes– Redundancy and fault-tolerance are MUST!

• More configuration– Per client on the servers– Trust relations among communicating servers

29

Impact on Internet/Intranet

• Tunnels– Several levels of nesting

Web server HomeAgent

LocalizedMobility Agent

PreviousAccessRouter

hostCurrentAccessRouter

Fast Handovers

Localized Mobility Management

Mobile IP

HomeAddress (Regional)

Care-ofAddress

(Older local)Care-ofAddress

(Current local)Care-ofAddress

30

Impact on Internet

• Address consumption– Always-on hosts– Purpose-specific address usage (home address, care-of

address)– Multihomed devices (GPRS, IEEE 802.11b, Bluetooth)– Sensor networks

31

Impact on Internet

• Suboptimal routing, redirect servers

host A

host B

HomeAgent A

HomeAgent B

32

Host Assumptions

• Can be anything:

• Dynamic auto-configuration needed:– IPv6 address auto-configuration (RFC 2462)– IPv6 prefix delegation (draft-troan-dhcpv6-opt-prefix-delegation-02.txt)– Service discovery (IPv6 anycast address support)

33

IPv6• IPv6 benefits:

– Ability to run server apps on devices (accept incoming connections)

– Plug-and-play– End-to-end IPsec for thwarting first-hop and last-hop threats– Mobile IPv6 : Efficient, easy to deploy and manage, and

scalable mobility protocol– Extensibility

• Mobile and wireless Internet will expedite the transition from IPv4-NAT to IPv6

• www.isoc.org/briefings/014/index.html

34

Conclusion

• Wireless and mobility provide tremendous benefits, but they come with a price.

• Transitioning the Internet protocols, architectures, products, and running networks should be done very carefully.

Questions?