Mobile Network Security Refik MOLVA Institut Eurcom B.P. 193 - - PowerPoint PPT Presentation

▶
mobile network security
SMART_READER_LITE
LIVE PREVIEW

Mobile Network Security Refik MOLVA Institut Eurcom B.P. 193 - - PowerPoint PPT Presentation

Apr 01, 2024 331 likes •956 views

Mobile Network Security Refik MOLVA Institut Eurcom B.P. 193 06904 Sophia Antipolis Cedex - France Refik.Molva@eurecom.fr Institut Eurecom 2005 Outline Wireless LAN 802.11 (WiFi) Mobile Telecommunications Security

slide-1
SLIDE 1

Mobile Network Security

Refik MOLVA Institut Eurécom B.P. 193 06904 Sophia Antipolis Cedex - France Refik.Molva@eurecom.fr

Institut Eurecom 2005

slide-2
SLIDE 2

Mobile Network Security - R. Molva 1

Outline

  • Wireless LAN
  • 802.11 (WiFi)
  • Mobile Telecommunications Security
  • GSM Security Features
  • 3GPP Security Architecture
  • CDPD Key agreement and authentication
  • Fraud management
  • Mobile IP
  • IPsec-based solution
  • Firewalls vs. Mobile IP vs. Packet Filtering

→

slide-3
SLIDE 3

Mobile Network Security - R. Molva 2

802.11 Wireless Networks

Ad Hoc Mode Infrastructure Mode

slide-4
SLIDE 4

Mobile Network Security - R. Molva 3

Association Establishment in Infrastructure Mode

Client Access Point Probe Request (SSID) Beacon(SSID) OR Authentication Association Response Association Request Deassociate OR Deauthenticate Various Alternatives Data Client is associated Client is not associated

slide-5
SLIDE 5

Mobile Network Security - R. Molva 4

Specific Vulnerabilities and Threats

  • lack of physical protection
  • eavesdropping and spoofing are easier than with wired

networks

  • denial of (data link layer) communication service is

feasible Main attacks:

  • eavesdropping
  • man in the middle
  • denial of service
slide-6
SLIDE 6

Mobile Network Security - R. Molva 5

Eavesdropping

  • 802.11is viewed as a standard Ethernet

but

– media is shared as opposed to switched – each node can receive all frames

  • traffic can be eavesdropped from few

kilometers away using appropriate equipment

slide-7
SLIDE 7

Mobile Network Security - R. Molva 6

Man in the Middle Attack

Victim Access Point Deassociate(Victim’s MAC@) Victim is not associated Attacker Beacon as Access Point

  • n different channel

Association Req. (Victim’s MAC@) Victim’s data traffic Association Resp. Association Req. (Victim’s MAC@) Association Resp. Victim’s data traffic Main reason why this attack works: Management frames (associate, deassociate) are not authenticated except in 802.11i. AP Victim Man in the Middle acts as

slide-8
SLIDE 8

Mobile Network Security - R. Molva 7

Denial of Service

  • Jamming
  • Virtual carrier-sense attack
  • Spoofing of deauthentication/deassociation messages
  • De-synchronization attacks
slide-9
SLIDE 9

Mobile Network Security - R. Molva 8

Security Requirements

  • no identification based on the physical access

→ Peer Entity Authentication → Data Origin Authentication

  • ease of disclosure and tampering with data

→ Data Confidentiality and Integrity → Privacy (Anonymity)

  • ease of access to communication media

→ Access Control (data link layer) → DoS prevention (?)

slide-10
SLIDE 10

Mobile Network Security - R. Molva 9

802.11 Network Access Control

  • Network Identification based on SSID (Service Set

Identifier)

– “secret” SSID shared by too many – Exchanged in cleartext – Ease of replay

  • Access Control: MAC-address based authorization to

Access Point

– MAC-addresses are not authenticated – MAC-addresses are easy to set on most cards

  • 802.1x

– Clients authenticated and screened by Radius Server – AP serves as proxy – Extensible Authentication Protocol (EAP)

slide-11
SLIDE 11

Mobile Network Security - R. Molva 10

802.11 Client and Data Security

  • Wireless Equivalent Privacy (WEP)
  • Wi-Fi Protected Access (WPA)
  • 802.11i (WPA2)
slide-12
SLIDE 12

Mobile Network Security - R. Molva 11

802.1x

  • General purpose network access control mechanism
  • 802.1x support in Access point
  • No impact on clients’ wireless interface
  • Authentication and Authorization by RADIUS server

– Extensible Authentication Protocol (EAP) RFC 2284

  • Alternative methods: password, smartcard, tokens, OTP
  • Alternative protocols: simple challenge response, EAP-

TLS.

– RADIUS server determines whether access to controlled ports of the AP should be allowed

slide-13
SLIDE 13

Mobile Network Security - R. Molva 12

802.1x Operational Flows

Client RADIUS Access Point Association Req. Association Resp. Authentication Success Authentication using EAP Authentication using EAP Authentication Success Data Access Authorized Access Denied

slide-14
SLIDE 14

Mobile Network Security - R. Molva 13

WEP Services

– Data Confidentiality – Data Integrity – Data Origin Authentication – Access control through client authentication by the AP

slide-15
SLIDE 15

Mobile Network Security - R. Molva 14

WEP

  • RC4 stream cipher
  • 40bit and 104bit keys
  • WEP key shared by all
  • No key distribution
slide-16
SLIDE 16

Mobile Network Security - R. Molva 15

WEP operation

  • K : shared key (40 or 104 bits)
  • integrity check: IC = h(header|data)
  • random initialization vector: IV (24 bits)
  • Keystream generation:

k = RC4(K, IV)

  • Encryption of data fragment m:

EK (m) = m ⊕ k

slide-17
SLIDE 17

Mobile Network Security - R. Molva 16

WEP packet

header IV ciphertext data IC k 802.11 packet header

slide-18
SLIDE 18

Mobile Network Security - R. Molva 17

WEP Encryption flaws

  • secret parts of P1 can be retrieved based on known parts of P2.
  • keystream can be retrieved similarly.
  • once keystreams are identified, new ciphertext can be decrypted

based on (cleartext) IV used as index to an array of known keystreams if keystreams are reused.

  • reuse of the same keystream:

– standards recommend, but do not require, a per-stream IV to combat this – Some PCMCIA cards reset IV to 0 each time they’re re-initialized and increment by 1, so expect reuse of low-value IVs – WEP only uses 24-bit IVs “birthday paradox”

If C1 = P1 ⊕ RC4(v,k) and C2 = P2 ⊕ RC4(v,k) C1 ⊕ C2 = (P1 ⊕ RC4(v,k)) ⊕ (P2 ⊕ RC4(v,k)) = P1 ⊕ P2

slide-19
SLIDE 19

Mobile Network Security - R. Molva 18

WEP Message Authentication Flaws

  • Hash function h, based on CRC-32, is a linear function of the

message: h(X) ⊕ h(Y) = h(X ⊕ Y) Modification attack: New (valid) ciphertext can be computed from existing ciphertext without the knowledge of the keystream:

  • Existing ciphertext C = RC4(k,v) ⊕ (M | h(M))
  • New ciphertext resulting from a desired modification(D) on C:

C’= C ⊕ (D | h(D)) = RC4(k,v) ⊕ (M | h(M)) ⊕ (D | h(D)) = RC4(k,v) ⊕ (M ⊕ D | h(M) ⊕ h(D)) = RC4(k,v) ⊕ (M ⊕ D | h(M ⊕ D))

slide-20
SLIDE 20

Mobile Network Security - R. Molva 19

WEP flaws continued

  • Using flaws in encryption and message authentication, further

attacks such as spoofing, dictionary attacks, traffic injection, route subversion can be mounted. Tools are available.

  • Management messages (deassociate, deauthenticate) are not

authenticated: DoS and MITM attacks still work.

  • Advanced attack:

Retrieve WEP keys using the attack described in "Weaknesses in the Key Scheduling Algorithm of RC4“ by Fluhrer, Mantin, and Shamir

– Airsnort http://airsnort.shmoo.com – WEPCrack http://wepcrack.sourceforge.net/

slide-21
SLIDE 21

Mobile Network Security - R. Molva 20

Wi-Fi Protected Access (WPA)

  • subset of the forthcoming IEEE 802.11i security standard (also

known as WPA2)

  • designed to overcome the weaknesses of WEP
  • Compatible with existing 802.11 hardware using firmware

upgrades

  • Features of WPA
  • Enhanced encryption scheme: Temporal Key Integrity Protocol

(TKIP)

– RC4, dynamic session keys – 48 bit IV

  • Non-linear Message Integrity Checks (MIC) based on Michael
  • Strong User Authentication using one of the standard Extensible

Authentication Protocol (EAP) types available

slide-22
SLIDE 22

Mobile Network Security - R. Molva 21

WPA2 - 802.11i

Ultimate improvements over WPA 802.11i Features

  • New encryption algorithm: Advanced

Encryption Standard (AES) → impact on hardware

  • Dynamic keys both for encryption and

authentication

slide-23
SLIDE 23

Mobile Network Security - R. Molva 22

Outline

  • Wireless LAN
  • 802.11 (WiFi)
  • Mobile Telecommunications Security
  • GSM Security Features
  • 3GPP Security Architecture
  • CDPD Key agreement and authentication
  • Fraud management
  • Mobile IP
  • IPsec-based solution
  • Firewalls vs. Mobile IP vs. Packet Filtering

→

slide-24
SLIDE 24

Mobile Network Security - R. Molva 23

GSM

Mobile Switching Center (MSC) Base Station (BS) Mobile Subscriber (MS) = Mobile Equipment (ME) + Subscriber Identity Module (SIM) Home Location Registry (HLR) Authentication Center (AuC) Visiting Location Registry (VLR) Wired Network HLR VLR MSC BTS BTS BTS BTS BTS BTS MSC VLR roaming Radio link MS AuC MS

slide-25
SLIDE 25

Mobile Network Security - R. Molva 24

Security Requirements

  • Security Threats

– Eavesdropping on the Radio interface

  • data confidentiality
  • User anonymity

– MS Impersonation (masquerade)

  • Security Services

– Subscriber identity protection – Subscriber authentication – Data confidentiality

Goal: Wireless security equivalent to wired Network

slide-26
SLIDE 26

Mobile Network Security - R. Molva 25

Subscriber Identity Protection in GSM

  • IMSI: universal identity (15 digits - 9 octets)
  • replaced by TMSI (temporary mobile subscriber identity) (4 octets)
  • First registration or after failure in VLR IMSI is sent in clear.
  • TMSI allocated by the VLR where the MS is registered.
  • TMSI protected by Data Confidentiality Service transmitted to MS.
  • Subsequent identification of MS by VLR is based on TMSI.
slide-27
SLIDE 27

Mobile Network Security - R. Molva 26

Authentication in GSM

  • bandwidth optimization: several verifications by the VLR can take place locally

without communicating with the remote HLR.

  • security: Ki is not disclosed to the VLR's of the visited areas.

MS Id (IMSI or TMSI) MS Id, VLR RAND SRES repeated with a different (RAND, SRES) for each authentication attempt

MSC/VLR HLR/AuC

Ki

wired network (trusted) radio link (vulnerable)

MS

Ki

Ki

A3

SIM Ki

A3

{(RAND, SRES, Kc)}

A8

RAND SRES Kc RAND Generation of triplets {(SRES, RAND, Kc)}

slide-28
SLIDE 28

Mobile Network Security - R. Molva 27

Data confidentiality in GSM

Kc Plaintext Ciphertext Frame Number 22

114

+2

64 114

A5

128

A8

Ki 128 RAND

SIM

MSC/VLR

radio link

MS

Kc Plaintext Frame Number +2

A5

Triplets from HLR {(RAND, SRES, Kc)}

RAND

slide-29
SLIDE 29

Mobile Network Security - R. Molva 28

GSM Algorithms

  • A3 and A8

– Defined by the network operator – Software implementation in the SIM

  • A5 stream cipher

– Hardware implementation in the ME – defined by the standard (interoperability) – Several versions: A5/1, A5/2, A5/3

slide-30
SLIDE 30

Mobile Network Security - R. Molva 29

  • Algorithm left at the discretion of the
  • perator
  • COMP128 - ill-advised by GSM standards

– 128-bit hash function – first 32 bits producing the A3 output – last 64 bits producing the A8 output – major weaknesses

  • A collision just requires 214 attempts

A3 and A8

slide-31
SLIDE 31

Mobile Network Security - R. Molva 30

A5/1

  • Based on a combination of LFSRs

clocking based on majority rule

22 21 18

slide-32
SLIDE 32

Mobile Network Security - R. Molva 31

Security of A5/1 and A5/2

  • A5/1

– Exhaustive search, complexity=264 – Attacks based on time-memory trade-off – Attack

  • 2 disks (73 GB)
  • 2 seconds of plaintext
  • Key retrieved in a minute
  • A5/2

– Similar design, deliberately weak

slide-33
SLIDE 33

Mobile Network Security - R. Molva 32

A5/3

  • Based on Block cipher
  • Output Feedback Mode with BLCKCNT

to prevent short cycles

  • No security by obscurity
  • Design by ETSI SAGE

– Based on Kasumi, derived from MISTY1 (Mitsubishi)

  • As part of 3GPP
slide-34
SLIDE 34

Mobile Network Security - R. Molva 33

Pros

  • Effective solution to cloning
  • Higher confidentiality compared with analogue systems

Cons

  • Security limited to access network
  • Lack of network authentication

– Risk of bogus base stations

  • Security by obscurity
  • Ill advised use of weak algorithms
  • Lack of control over activation of security for user and

home network

  • Lack of lawful interception

GSM Security - Summary

slide-35
SLIDE 35

Mobile Network Security - R. Molva 34

Outline

  • Wireless LAN
  • 802.11 (WiFi)
  • Mobile Telecommunications Security
  • GSM Security Features
  • 3GPP Security Architecture
  • CDPD Key agreement and authentication
  • Fraud management
  • Mobile IP
  • IPsec-based solution
  • Firewalls vs. Mobile IP vs. Packet Filtering

→

slide-36
SLIDE 36

Mobile Network Security - R. Molva 35

  • Build on the security of GSM

– adopt security features that have proved to be needed and that are robust – ensure compatibility with GSM to ease inter- working and handover

  • Fix the security flaws of GSM
  • Enhance with new security features to suit

– new services – changes in network architecture

  • Keep minimal trust in intermediate components

Objectives of 3GPP Security

slide-37
SLIDE 37

Mobile Network Security - R. Molva 36

  • Mutual authentication between user and

base station

  • No security by obscurity

– Make sure chosen algorithms have been tested by the scientific community

  • Flexibility in standards
  • Change in law enforcement for

cryptography: longer keys (≥128 bits)

Lessons from GSM

slide-38
SLIDE 38

Mobile Network Security - R. Molva 37

  • Mutual Authentication between User and

Network

  • Data Confidentiality (user traffic and

signalling data) (like GSM)

  • User identity protection (like GSM)
  • Data Integrity (over the air interface)

3GPP Security Services

slide-39
SLIDE 39

Mobile Network Security - R. Molva 38

Authentication & Key Agreement (AKA)

Objectives

  • Mutually authenticate user to network
  • Establish shared keys between user and

network

– CK: 128-bit encryption key – IK: 128-bit integrity key

  • Assure freshness of CK/IK
  • Authenticated management field HLR →

USIM

– Authentication key and algorithm identifiers – Limit CK/IK usage for each AKA execution

slide-40
SLIDE 40

Mobile Network Security - R. Molva 39

AKA Message Flows

Authentication data request RAND, AUTN RES Mutual authentication And key agreement

VLR/SGSN HLR/AuC

K

USIM

K

{(RAND, XRES, CK, IK, AUTN)} Verify MAC, SQN Derive CK, IK, RES Verify: RES=XRES ? Start using CK, IK Start using CK, IK MS Id (IMSI or TMSI) Protected Data

slide-41
SLIDE 41

Mobile Network Security - R. Molva 40

Data Encryption

  • Applied on User & Signaling Data
  • Over the air interface
  • Stream Cipher
  • Provision for different Algorithms
  • Including Kasumi (A5/3 of GSM)
slide-42
SLIDE 42

Mobile Network Security - R. Molva 41

Outline

  • Wireless LAN
  • 802.11 (WiFi)
  • Mobile Telecommunications Security
  • GSM Security Features
  • 3GPP Security Architecture
  • CDPD Key agreement and authentication
  • Fraud management
  • Mobile IP
  • IPsec-based solution
  • Firewalls vs. Mobile IP vs. Packet Filtering

→

slide-43
SLIDE 43

Mobile Network Security - R. Molva 42

Cellular Digital Packet Data (CDPD)

  • Data communication over the analog AMPS network
  • Full-fledge network architecture including several layers
  • Security services:
  • mobile unit authentication
  • data confidentiality over the wireless link
  • key exchange
slide-44
SLIDE 44

Mobile Network Security - R. Molva 43

CDPD - Mobile Unit Authentication

NEI : mobile unit id ARN : nonce ASN : sequence number

Key exchange using Diffie-Hellman MD-IS key exchange M-ES key exchange M-ES hello Redirection request NEI, ARN, ASN Redirection confirm ARN’, ASN + 1 Verification MD-IS confirm RC4 (Ks, NEI, ARN’, ASN+1) RC4 (Ks, NEI, ARN, ASN) Ks = gyx Ks = gxy MD-IS “home” MD-IS “remote” Wired network (trusted) M-ES Radio link (vulnerable)

slide-45
SLIDE 45

Mobile Network Security - R. Molva 44

Fraud Management in Mobile Networks

Threats:

  • Access fraud
  • Subscription fraud

Security mechanisms like authentication and confidentiality prevent access fraud but they cannot help with subscription fraud. Solution: real-time fraud detection Principle:

  • monitor subscriber behavior in real-time
  • based on connection tickets
  • detect deviations with respect to user/class profile
  • prompt suspected users with explicit authentication challenge
  • adapt user/class profile based on the monitoring
slide-46
SLIDE 46

Mobile Network Security - R. Molva 45

Outline

  • Wireless LAN
  • 802.11 (WiFi)
  • Mobile Telecommunications Security
  • GSM Security Features
  • 3GPP Security Architecture
  • CDPD Key agreement and authentication
  • Fraud management
  • Mobile IP
  • IPsec-based solution
  • Firewalls vs. Mobile IP vs. Packet Filtering

→

slide-47
SLIDE 47

Mobile Network Security - R. Molva 46

Mobile IP

Mobile Node (MN) - Correspondent Node (CN) Home Agent (HA) - Foreign Agent (FA) CN → MN : IP within IP tunneling between HA and FA:

  • outer IP: dst@: care of address(COA), src @: HA@
  • inner IP: dst@: MN@, src@: CN@

MN → CN : regular IP HA FA MN CN Internet home network registration data flow

slide-48
SLIDE 48

Mobile Network Security - R. Molva 47

Mobile IP Security Requirements

MN registration

  • impersonation of MN by intruders or malicious FA
  • replay
  • subversion of traffic destined to MN

Solution: authentication of MN by HA

  • Mobile IPv4
  • Authentication based on keyed MD5 or HMAC using timestamps or nonces
  • Mobile IPv6
  • default IP AH support
  • security association between MN and HA
  • key management might be a problem.
slide-49
SLIDE 49

Mobile Network Security - R. Molva 48

Mobile IP Security Requirements

CN → HA → MN

Difference / wired networks: MN possibly located in an untrusted remote network Solution: IPsec

  • IP Authentication Header
  • IP Encapsulating Security Payload
  • Key Management

Mandatory requirement: Security Association between HA and MN. End-to-end security: SA between CN and MN

MN → CN

Exposure is similar Solution: IPsec with an SA between MN and CN

slide-50
SLIDE 50

Mobile Network Security - R. Molva 49

Mobile IP vs. Firewalls

  • Firewall traversal for Mobile IP

Firewall policy (usually) does not allow inbound connections from external networks. How can a remote MN connect to the home network under such policy.

  • ingress filtering

Even if there is no firewall, simple packet filtering exists in most networks. Mobile IP traffic can be blocked by such filtering.

  • CN's inside home network may use private IP addresses together with NAT

MN → CN packets may simply not get routed in Internet. Solution for all: IPsec tunneling through the firewall

slide-51
SLIDE 51

Mobile Network Security - R. Molva 50

Mobile IP vs. Packet Filtering

MN@ does not belong to remote network. If packet filtering is implemented problems may arise:

  • MN → CN packets gets rejected by remote network filtering because they have

an illegal source address (outbound packet with an external source address).

  • MN → home network packets get rejected by the filtering at the home network

because they have an illegal source address (inbound packet with an internal source address). Such packet filtering is due to countermeasures called anti-spoofing.

slide-52
SLIDE 52

Mobile Network Security - R. Molva 51

Anti-spoofing

IP Spoofing Attacks based on IP packets with bogus source address:

  • Land attacks: src@=dst@, destination host hangs.
  • smurf: ping with directed broadcast address may use a bogus source

address in the same network as the destination; the host at the source address gets flooded by the replies to the broadcast.

  • SYN attacks: TCP SYN packet causes allocation of kernel memory, may

use bogus source address belonging to the destination network. Anti-spoofing measures Drop packets with obvious inconsistency:

  • outbound packet with an external source address
  • inbound packet with an internal source address
  • inbound packets with private IP source address

Cisco IOS anti-spoofing rules for network 192.65.32.0/24

  • on the external router interface (inbound packets):

access-list 101 deny ip 192.65.32.0 0.0.0.255 any

  • on the internal router interface (outbound packets):

access-list 101 permit ip 192.65.32.0 0.0.0.255 any access-list 101 deny ip any any log

slide-53
SLIDE 53

Mobile Network Security - R. Molva 52

Anti-spoofing vs. Mobile IP

Why MIP packets get blocked by anti-spoofing ? MN → CN1 packets blocked by the ingress anti-spoofing in router R1: access-list 101 permit ip 192.35.73.0 0.0.0.255 any access-list 101 deny ip any any log MN → CN2 packets blocked by egress anti-spoofing in router R2: access-list 101 deny ip 172.45.0.0 0.0.255.255 any MN R1 Ingress filtering Egress filtering CN1 CN2 R2 Internet 172.45.3.2 remote network 192.35.73.x 203.74.21.5 172.45.3.1 home network 172.45.x.x

slide-54
SLIDE 54

Mobile Network Security - R. Molva 53

How can MIP pass through anti-spoofing

Reverse tunneling to by-pass anti-spoofing Packets originated at MN

  • take the path MN → FA → HA → CN2
  • IPwithinIP encapsulation between FA and HA:

No illegal addresses any more. Packet filtering FA MN CN1 CN2 HA Internet R1 R2 HA@ FA@ MN@ CN2@ inner IP header

  • uter IP header
slide-55
SLIDE 55

Mobile Network Security - R. Molva 54

New problem with Reverse Tunnelling

Intruders can perpetrate spoofing attacks by sending encapsulated (IPIP) packets with bogus addresses in the inner header. ⇒ No spoofing defense any more

slide-56
SLIDE 56

Mobile Network Security - R. Molva 55

How can MIP pass through anti-spoofing

Direct tunnelling of data traffic by MN: IPwithinIP encapsulation between MN and CN: COA: Care of address Problem: CN must be able do de-encapsulate IPIP packets. Internet CN MN R1 CN@ COA MN@ CN@ inner IP header

  • uter IP header
slide-57
SLIDE 57

Mobile Network Security - R. Molva 56

Solution: Firewall compatible with Mobile IP

Idea:MN should enjoy the same level of connectivity and security as if it were in the secure home network. Principle: all traffic between MN and home network goes through a firewall. Problems due to filtering and addressing discrepancies are also solved. Possible approaches:

  • Application gateway or circuit gateway:
  • strong authentication
  • complex interactions
  • no data confidentiality and integrity
  • IPsec tunnelling
  • most suitable to create a virtual home network abroad
  • external links can be viewed as secure as internal ones
  • data confidentiality and integrity in addition to authentication
slide-58
SLIDE 58

Mobile Network Security - R. Molva 57

IPsec tunnelling Firewall

Registration request SA Internet FW HA MN Router

remote network home network

  • Optional tunnel SA between FW and HA
  • SA's must be established manually or using key management (IKE, ISAKMP)
  • FW retrieves security parameters of the SA using the SPI in the IPsec (AH or ESP) header.

IP Datagram between MN and FW Tunnel Mode SA IP Datagram between FW and HA IP2 ESP IP1 IP2 AH IP1 registration request registration request IP1 : src@=COA; dst@=HA@ IP2 : src@=COA; dst@=FW@ registration request IP1 COA : care of address obtained from DHCP COA ∈ remote network

slide-59
SLIDE 59

Mobile Network Security - R. Molva 58

IPsec tunnelling Firewall

Data flow

  • Optional FW-CN tunnel SA or MN-CN transport/tunnel SA
  • SA's must be established manually or using key management (IKE, ISAKMP)
  • FW retrieves security parameters of the SA using the SPI in the IPsec (AH or ESP) header.

SA Internet FW CN MN Router

remote network home network

IP Datagram between MN and FW Tunnel Mode SA IP2 ESP IP1 IP2 AH IP1 data data IP Datagram between FW and CN data IP1 IP1 : src@=MN@; dst@=CN@ IP2 : src@=COA; dst@=FW@ COA ∈ remote network MN @ ∈ home network

slide-60
SLIDE 60

Mobile Network Security - R. Molva 59

IPsec tunnelling Firewall - Conclusion

  • Secure extension of protected home network to mobile nodes abroad
  • By-product: packet filtering problems are avoided
  • communications between MN at home and external CN: regular (non-mobile)

security controls apply in this case.

  • communications between MN on public network and external CN: use bi-directional

IPsec tunnels.