IP Mobility: IP Mobility: Threat Models and Security Requirements - PowerPoint PPT Presentation

IP Mobility: IP Mobility: Threat Models and Security Requirements Threat Models and Security Requirements Vidya Narayanan (vidyan@qualcomm.com vidyan@qualcomm.com) ) Vidya Narayanan ( Lakshminath Dondeti (ldondeti@qualcomm.com ldondeti@qualcomm.com) ) Lakshminath Dondeti (

Outline Outline Introduction and Goals Introduction and Goals Typical network architecture Typical network architecture Assets Assets Internet Threat Model – – A Recap A Recap Internet Threat Model Routing and IP Mobility Routing and IP Mobility Security analysis of IP mobility protocols Security analysis of IP mobility protocols Security Requirements Security Requirements Security Models Security Models IETF- -67 INT Area 67 INT Area 2 2 IETF

Introduction and Goals Introduction and Goals IP Mobility handles changes to the IP point of presence IP Mobility handles changes to the IP point of presence (PoP) (PoP) – Forwards packets meant for an Forwards packets meant for an “ “anchor anchor” ” IP address to a IP address to a – “transient transient” ” IP address IP address “ – Several models (global, local, host Several models (global, local, host- -based, network based, network- -based) based) – Aid analysis of threat models for IP mobility protocols Aid analysis of threat models for IP mobility protocols Remove the guesswork in threats Remove the guesswork in threats Provide high level security requirements for IP mobility Provide high level security requirements for IP mobility protocols protocols Allow evaluation of a security solution Allow evaluation of a security solution IETF- -67 INT Area 67 INT Area 3 3 IETF

Overall Mobility Architecture Overall Mobility Architecture CN 1 Internet AAAH MA CN 3 CA Local Home Network Network AAAL CN 2 MA CA AR AR L3 Mobility Management Entity L2 PoP1 L2 PoP2 L2 PoP3 L2 PoP4 L2 Mobility Management Entity Security Infrastructure Entity MN Correspondent Entity IETF- -67 INT Area 67 INT Area 4 4 IETF

Definitions Definitions Mobility Agent Mobility Agent – Entity maintaining state on location of mobile nodes Entity maintaining state on location of mobile nodes – E.g., MIP HA, FMIP pAR, HMIP MAP, NETLMM LMA, MIP RO- -enabled CN enabled CN E.g., MIP HA, FMIP pAR, HMIP MAP, NETLMM LMA, MIP RO Mobility Facilitators Mobility Facilitators – Other entities that facilitate IP mobility Other entities that facilitate IP mobility – E.g., NETLMM MAG, MIP4 FA, HMIP AR E.g., NETLMM MAG, MIP4 FA, HMIP AR – It is plausible for these to fail/be compromised without denial It is plausible for these to fail/be compromised without denial of service of service – Mobility Provider Mobility Provider – Mobility Agent or Mobility Facilitator Mobility Agent or Mobility Facilitator – Mobility Recipient Mobility Recipient – Entity receiving the IP mobility service Entity receiving the IP mobility service – – Mobile node is the recipient – Mobile node is the recipient IETF- -67 INT Area 67 INT Area 5 5 IETF

Assets Assets Critical Assets Critical Assets – Failure/compromise of these assets leads to failed mobility sess Failure/compromise of these assets leads to failed mobility sessions ions – Mobile Node Mobile Node Mobility Agent Mobility Agent Security Infrastructure Entities Security Infrastructure Entities Non- -critical Assets critical Assets Non – The mobility session can continue despite failure/compromise of The mobility session can continue despite failure/compromise of these these – assets assets Network infrastructure, including links Network infrastructure, including links Mobility facilitators (e.g., ARs, routers) Mobility facilitators (e.g., ARs, routers) Other Assets Other Assets – Correspondent Nodes Correspondent Nodes – – Other nodes (mobile or fixed) attaching to the mobility domain Other nodes (mobile or fixed) attaching to the mobility domain – Not all assets are applicable for all mobility models Not all assets are applicable for all mobility models IETF- -67 INT Area 67 INT Area 6 6 IETF

The Internet Threat Model – – A Recap A Recap The Internet Threat Model Assumption 1: Critical assets are not compromised Assumption 1: Critical assets are not compromised Assumption 2: The attacker has full control of the communication Assumption 2: The attacker has full control of the communication channel channel – Attacker can read, inject, remove, modify any packets without de Attacker can read, inject, remove, modify any packets without detection tection – Types of attacks Types of attacks – – Passive attacks Passive attacks – Active attacks Active attacks – – Off Off- -path Attacks path Attacks – – On – On- -path Attacks path Attacks Superset of Off Superset of Off- -path attacks path attacks Reference: RFC3552 Reference: RFC3552 Are all these assumptions and/or attacks applicable to IP mobility ty Are all these assumptions and/or attacks applicable to IP mobili protocols? protocols? Are there other assumptions and/or attacks that are applicable to IP o IP Are there other assumptions and/or attacks that are applicable t mobility protocols? mobility protocols? IETF- -67 INT Area 67 INT Area 7 7 IETF

Routing and Byzantine Failures Routing and Byzantine Failures A network can function in the presence of Byzantine failures A network can function in the presence of Byzantine failures – Entities lying about routing or other information selectively, w Entities lying about routing or other information selectively, while hile – appearing to function correctly (due to compromise, mis appearing to function correctly (due to compromise, mis- -configuration) configuration) As long as there is a non- -faulty path between nodes A and B, they faulty path between nodes A and B, they As long as there is a non can communicate can communicate – Even if the adversary sends bogus and disparate information to Even if the adversary sends bogus and disparate information to – legitimate infrastructure entities, e.g., routers legitimate infrastructure entities, e.g., routers B A IETF- -67 INT Area 67 INT Area 8 8 IETF

Mobility and Failure of Non- -critical Nodes critical Nodes Mobility and Failure of Non Mobility signaling is possible even if one a few non- -critical assets fail critical assets fail Mobility signaling is possible even if one a few non in an adversarial fashion in an adversarial fashion Mobility facilitators may fail in a Byzantine fashion, yet MNs can and an and Mobility facilitators may fail in a Byzantine fashion, yet MNs c should be able to get service should be able to get service MA AR C AR MN MN IETF- -67 INT Area 67 INT Area 9 9 IETF

Don’ ’t Mess With Routing! t Mess With Routing! Don A protocol among a given set of entities must not A protocol among a given set of entities must not impact routing for unrelated entities impact routing for unrelated entities – – D’ D ’s malicious use of a protocol between C and D MUST not s malicious use of a protocol between C and D MUST not impact communication between A and B impact communication between A and B B C A D IETF- -67 INT Area 67 INT Area 10 10 IETF

Outline Outline Introduction and Goals Introduction and Goals Introduction and Goals Defining IP Mobility Defining IP Mobility Defining IP Mobility IP Mobility Models IP Mobility Models IP Mobility Models Typical network architecture Typical network architecture Typical network architecture Assets Assets Assets Internet Threat Model – A Recap Internet Threat Model – – A Recap A Recap Internet Threat Model Routing and IP Mobility Routing and IP Mobility Routing and IP Mobility Security analysis of IP mobility protocols Security analysis of IP mobility protocols – Threats to IP mobility – Threats to IP mobility “ “providers providers” ” – – Threats to IP mobility Threats to IP mobility “ “recipients recipients” ” – Off Off- -path vs. on path vs. on- -path attacks path attacks – – Threats enabled by mobility protocols Threats enabled by mobility protocols – Security Requirements Security Requirements Security Requirements Security Models Security Models Security Models IETF- -67 INT Area 67 INT Area 11 11 IETF

Threats to IP Mobility Provider Threats to IP Mobility Provider Provider’ ’s interests s interests Provider – Ensuring that only authorized entities obtain the service Ensuring that only authorized entities obtain the service – Ensuring that service is provided as intended Ensuring that service is provided as intended – Only entities served by the provider are able to create state at Only entities served by the provider are able to create state at – the mobility agent the mobility agent Threats to mobility “ “agents agents” ” Threats to mobility – Creation of state by unauthorized nodes Creation of state by unauthorized nodes – – Creation of incorrect state for valid nodes Creation of incorrect state for valid nodes – Threats to mobility “ “facilitators facilitators” ” Threats to mobility – Creation of spurious state at the facilitator Creation of spurious state at the facilitator – – Use of facilitator to disrupt IP mobility – Use of facilitator to disrupt IP mobility IETF- -67 INT Area 67 INT Area 12 12 IETF