Mobile Networking As Applied to Any Mobile Network

Mobile Networking As Applied to Any Mobile Network Including Aeronautical Internets Airborne Internet Collaboration Group meeting April 17, 2003 Will Ivancic – wivancic@grc. nasa. gov 1

Outline n n n n Mobile Networking Solutions Aeronautical Telecommunication Network (ATN) Mobile-IPv 4 Operation Secure Mobile Network Demonstration Mobile-IPv 6 Operation Networks In Motion (NEMO) NASA Glenn Research Center Research 2

Mobile Networking Solutions n Routing Protocols n n Mobile-IP n n n Route Optimization Convergence Time Sharing Infrastructure – who owns the network? Route Optimization Convergence Time Sharing Infrastructure Security – Relatively Easy to Secure Domain Name Servers n n n Route Optimization Convergence Time Reliability 3

Aeronautical Communication Requirements for ATN n n n Interoperability with existing subnetworks High availability Mobile Communication Message prioritization Policy based routing Security n n Just now being considered Bit Efficiency Support for multiple mobile subnetworks Mobile platforms its own Routing domain 4

Aeronautical Communication Requirements – Questions? n How much is politics, how much is technical requirements. n Policy based routing n n Security – Previously undefined n n Can Links handle Authentication, Authorization, Accounting and Encryption? Bit Efficiency n n Is this a political or technical requirement? Is this due to limited links. Load Sharing of RF links n n Is this specified, implied or not necessary Current (and perhaps future) implementations of Mobile Networking do not support this. 5

ATN Non-Requirements n n n n n Sharing Infrastructure Multicasting Interoperate with non-ATN applications Unidirectional Link Routing Use of Commodity products and protocols Cost Effective Flexible Adaptable Evolvable 6

ATN Solutions for Mobility n n n Uses Inter-Domain Routing Protocol (IDRP) for routing Implements distributed IDRP directory using Boundary Intermediate Systems (BISs) Two level directory n ATN Island concept consisting of backbone BISs n Home BISs concept Scalability obtained by the two level structure Resilience is provided by the distributed approach 7

ATN n ATN Routing uses the IDRP Routing Protocol n n IDRP supports policybased routing which allows administrations to autonomously control use of their network IDRP supports mobility by permitting aggregate routes to be selectively propagated through the network 8

ATN Island Routing Domain Confederation Structure To another ATN Island Mobile RD Non-ATN RD Mobile RD ATN Backbone RDC ATN TRD Fixed ATN ERD – End RD RDC – RD Confederation TRD – Transit RD Fixed ATN ERD ATN Island RDC 9

Pick Your Satellite Service Suppliers Pick Your Radio (i. e. 802. 11) Mobile RD Internet ATN Backbone RDC ATN TRD ATN Island RDC Fixed ATN ERD 10

Moblile-IP Operation IPv 4 11

Mobile-IP (IPv 4) using Foreign Agents Mobile Node “ ” Foreign Agent 143. 232. 48. 1 Home IP 128. 183. 103 Care-Off-Address 139. 88. 111. 50 Foreign Agent 139. 88. 111. 1 139. 88. 112. 1 NASA Glenn 143. 232. 48. 1 NASA Ames Internet or Intranet Corresponding Node 128. 183. 1 NASA Goddard Home Agent Bi-directional Tunnel if Reverse Tunneling Is specified. 12

Mobile-IP (IPv 4) using Foreign Agents Mobile Node “ ” Foreign Agent 143. 232. 48. 1 Home IP 128. 183. 103 Care-Off-Address 139. 88. 111. 50 Foreign Agent 139. 88. 111. 1 139. 88. 112. 1 NASA Glenn 143. 232. 48. 1 NASA Ames Internet or Intranet 128. 183. 1 NASA Goddard Corresponding Node Home Agent 13

Mobile-IP (IPv 4) using Foreign Agents (Reverse Tunneling) Mobile Node “ ” Foreign Agent 143. 232. 48. 1 Home IP 128. 183. 103 Care-Off-Address 139. 88. 111. 50 Foreign Agent 139. 88. 111. 1 139. 88. 112. 1 NASA Glenn 143. 232. 48. 1 NASA Ames Internet or Intranet 128. 183. 1 NASA Goddard Corresponding Node Home Agent 14

Mobile-IP (IPv 4) using Collocated Care-Of-Address DHCP or Connection Established Mobile Node “ ” Access Router 143. 232. 48. 1 Home IP 128. 183. 103 Care-Off-Address 139. 88. 111. 50 Access Router 139. 88. 111. 1 139. 88. 112. 1 NASA Glenn 143. 232. 48. 1 NASA Ames Internet or Intranet 128. 183. 1 NASA Goddard Corresponding Node Home Agent Bi-directional Tunnel if Reverse Tunneling Is specified. 15

Mobile-IP (IPv 4) using Collocated Care-Of-Address Mobile Node “ ” Access Router 143. 232. 48. 1 Home IP 128. 183. 103 Care-Off-Address 139. 88. 111. 50 Access Router 139. 88. 111. 1 139. 88. 112. 1 NASA Glenn 143. 232. 48. 1 NASA Ames Internet or Intranet 128. 183. 1 NASA Goddard Corresponding Node Home Agent 16

Mobile-IP (IPv 4) using Collocated Care-Of-Address (Reverse Tunneling) Mobile Node “ ” Access Router 143. 232. 48. 1 Home IP 128. 183. 103 Care-Off-Address 139. 88. 111. 50 Access Router 139. 88. 111. 1 139. 88. 112. 1 NASA Glenn 143. 232. 48. 1 NASA Ames Internet or Intranet 128. 183. 1 NASA Goddard Corresponding Node Home Agent 17

Mobile-Router (IPv 4) Mobile Router 128. 184. 24. 1 128. 184. 2 Virtual LAN Interface Bi-directional Tunnel if Reverse Tunneling Is specified. 10. 2. 2. 1 Roaming Interface Tunnel-0 139. 88. 100. 1 FA WAN Mobile Router (Mobile Node) 128. 184. 26. 1 MR Loopback Virtual Interface COA 139. 88. 100. 1 Tunnel-1 Foreign Agent Internet 139. 88. 112. 1 Internet WAN 128. 183. 1 Internet WAN Home Agent 128. 184. 25. 1 HA Loopback Virtual Interface Corresponding Node 18

Mobile-Router (IPv 4) Mobile Router (Reverse Tunneling) 128. 184. 24. 1 Virtual LAN Interface 10. 2. 2. 1 Roaming Interface Tunnel-0 139. 88. 100. 1 FA WAN 128. 184. 2 Mobile Router (Mobile Node) 128. 184. 26. 1 MR Loopback Virtual Interface COA 139. 88. 100. 1 Tunnel-1 Foreign Agent Internet 139. 88. 112. 1 Internet WAN 128. 183. 1 Internet WAN Home Agent 128. 184. 25. 1 HA Loopback Virtual Interface Corresponding Node 19

Mobile-Router (IPv 4) Collocated Care-Of-Address 128. 184. 24. 1 Virtual LAN Interface 128. 184. 2 Mobile Router (Mobile Node) 10. 2. 2. 1 Roaming Interface 128. 184. 26. 1 MR Loopback Virtual Interface COA 139. 88. 100. 1 Tunnel-0 139. 88. 100. 1 FA WAN Tunnel-1 Foreign Agent Internet 128. 183. 1 Internet WAN 139. 88. 112. 1 Internet WAN No Foreign Agent No Second Tunnel Home Agent 128. 184. 25. 1 HA Loopback Virtual Interface Corresponding Node 20

Mobile-Router (IPv 4) Collocated Care-Of-Address 128. 184. 24. 1 Virtual LAN Interface 10. 2. 2. 1 Roaming Interface Tunnel-0 139. 88. 100. 1 128. 184. 2 Mobile Router (Mobile Node) 128. 184. 26. 1 MR Loopback Virtual Interface COA 139. 88. 100. 1 Access Router Internet 139. 88. 112. 1 Internet WAN 128. 183. 1 Internet WAN Home Agent 128. 184. 25. 1 HA Loopback Virtual Interface Corresponding Node 21

Mobile Networking Additional Features Geographically Distributed Home Agents n. Asymmetrical Pathing n 22

Secondary Home Agent (reparenting the HA) Primary Home Agent X Secondary Home Agent Reparenting Home Agent Helps resolve triangular routing Problem over long distances 23

Emergency Backup (Hub / Spoke Network) If primary control site becomes physically inaccessible but can be electronically connected, a secondary site can be established. If primary control site is physically incapacitated, there is no backup capability. 24

Secondary Home Agent (Fully Meshed Network) If primary control site is physically incapacitated, a second or third or forth site take over automatically. 3 5 1 2 4 25

Asymmetrical Pathing DVB Satellite Mil. Star, Globalstar, Others Mobile Router Internet Foreign Agent Home Agent 26

Securing Mobile and Wireless Networks Some ways may be “better” than others! 27

Constraints / Tools n n n Policy Architecture Protocols 28

IPv 4 Utopian Operation CN US Coast Guard Operational Network (Private Address Space) US Coast Guard Mobile Network Public Internet HA FA Triangular Routing MR 29

IPv 4 Mobile-IP Addressing n Source Address is obtained from n n n Foreign Agent Static Collocated Care-of-Address (CCo. A) DHCP via Access Router (Dynamic CCo. A) Private Address space is not routable via the Open Internet Topologically Incorrect Addresses should be blocked via Ingress or Egress filtering 30

IPv 4 “Real World” Operation CN US Coast Guard Operational Network (Private Address Space) US Coast Guard Mobile Network Public Internet FA MR P R O X y HA Proxy had not originated the Glenn Research Center request; therefore, the. Policy: USCG Requires 3 DES encryption. No UDP, IPSec, etc… response is. Egress squelched. Ingress or. No Filtering stops WEP is notstopped acceptable due to Mobile-IP its tracks. Peer-to-peer networking Transmission due tointopologically known deficiencies. What’s your policy? becomes problematic at best. Incorrect source address. IPv 6 Corrects this problem. 31

Current Solution – Reverse Tunneling CN Adds Overhead and kills route optimization. US Coast Guard Mobile Network US Coast Guard Operational Network (Private Address Space) Public Internet FA MR P R O X y HA Anticipate similar problems for IPv 6. 32

Shared Network Infrastructure MR MR Canadian Coast Guard FA ACME Shipping FA HA Public Internet MR HA US Coast Guard M R US Navy Encrypting wireless links HA makes it very difficult to ACME share infrastructure. SHIPPING HA This is a policy issue. 33

Security • • Security Bandwidth Utilization Security Performance Tunnels and more Tunnels Performance Security User turns OFF Security to make system usable! • Thus, we need more bandwidth to ensure security. ENCRYPTION ON THE RF LINK ENCRYPTION AT THE NETWORK LAYER VIRTUAL PRIVATE NETWORK ORIGINAL PACKET HEADER PAYLOAD 34

Additional and Future Security Solutions n AAA n n Routers (available today) Wireless bridges and access points (available 2002) IPSec on router interface Encrypted radio links n IPSec, type 1 or type 2, and future improved WEP 35

Conclusions n Security Breaks Everything n n At least it sometimes feels like that. Need to change policy where appropriate. Need to develop good architectures that consider how the wireless systems and protocols operate. Possible solutions that should be investigated: n Dynamic, Protocol aware firewalls and proxies. n Possibly incorporated with Authentication and Authorization. 36

USCGC Neah Bay Project Mobile Networking in an Operational Network 37

Mobile Network Design Goals n n n Secure Scalable Manageable Ability to sharing network infrastructure Robust 38

Neah Bay / Mobile Router Project Detroit Foreign-Agent Neah Bay Outside of wireless LAN range, connected to FA via Inmarsat. Neah Bay Connected to FA via wireless LAN at Cleveland harbor Foreign-Agent Somewhere, USA Home-Agent Anywhere, USA Foreign-Agent Clevelan d Internet 39

Why NASA/USCG/Industry n n n Real world deployment issues can only be addressed in an operational network. USCG has immediate needs, therefore willingness to work the problem. USCG has military network requirements. USCG is large enough network to force full us to investigate full scale deployment issues USCG is small enough to work with. NASA has same network issues regarding mobility, security, network management and scalability. 40

Mobile-Router Advantages n Share wireless and network resources with other organizations n n Set and forget n n n No onsite expertise required However, you still have to engineer the network Continuous Connectivity n n $$$ savings (May or may not be important to your organization) Robust n Secondary Home Agent (Reparenting of HA) 41

Shared Network Infrastructure MR MR Canadian Coast Guard FA ACME Shipping FA HA Public Internet MR HA US Coast Guard M R US Navy Encrypting wireless links HA makes it very difficult to ACME share infrastructure. SHIPPING HA This is a policy issue. 42

We Are Running with Reverse Tunneling n Pros n n n Ensures topologically correct addresses on foreign networks Required as requests from MR LAN hosts must pass through Proxy inside main firewall Greatly simplifies setup and management of security associations in encryptors Greatly simplifies multicast – HA makes for an excellent rendezvous point. Cons n n Uses additional bandwidth Destroys route optimization 43

INTERNET PROXY MR Tunnel Endpoint (Public Space) FIREWALL Encryption Mobile LAN 10. x. x. x USCG INTRANET 10. x. x. x FA - Detroit Encryption HA 802. 11 b link Public Address FA – Cleveland HA Tunnel Endpoint (Public Space) 44

Dock EAST INTERNET FA - Detroit PROXY WEST FIREWALL Mobile LAN 10. x. x. x Encryption Open Network Data Transfers USCG INTRANET 10. x. x. x Dock Encryption EAST WEST HA FA Cleveland 802. 11 b link Public Address USCG Officer’s Club 45

Dock EAST INTERNET PROXY WEST FIREWALL Mobile LAN 10. x. x. x Encryption Encrypted Network Data Transfers USCG INTRANET 10. x. x. x FA - Detroit Encryption EAST WEST HA Dock 802. 11 b link FA Cleveland Public Address USCG Officer’s Club 46

RF Bandwidth Mobile LAN 10. x. x. x Encryption 7 Kbps to 56 Kbps in 7 Kbps chunks (1 to 2. 5 seconds delay) Dock 11. 0 Mbps (auto-negotiated and shared with Officer’s Club) EAST 1. 0 Mbps (manually set) WEST 1. 0 Mbps (manually set) 47

Globalstar/Sea Tel MCM-8 n n Initial market addresses maritime and pleasure boaters. Client / Server architecture n n Current implementation requires call to be initiated by client (ship). Multiplexes eight channels to obtain 56 kbps total data throughput. Full bandwidth-on-demand. Requires use of Collocated Care-of-Address 48

RF Technologies n Globalstar (L-Band) n n n n Globalstar MCM-8 (Client/Server) Seatel MCM-3 (Client/Server) Qualcomm MDSS-16 Boeing Connex (Ku-Band) INMARSAT Swift 64 General Packet Radio Service (GPRS) 802. 11 VHF 49

50

What’s Next The End Game 51

Mobile Networks n Share Network Infrastructure n n USCG, Canadian Coast Guard, Commercial Shipping, Pleasure Boaters Open Radio Access / Restricted Network Access n n Authentication, Authorization and Accounting Architecture n Limited, experimental deployment onboard Neah Bay n n Move RIPv 2 routing from Fed. Bldg to Neah Bay Move to full scale deployment n Requires full commitment 52

Mobile LAN 10. x. x. x PROXY PIX-506 MR Public INTERNET INTRANET 10. x. x. x FA – Cleveland Public FA - Detroit 802. 11 b link HA Public PIX- 506 – until we install our PIX FW Then we should not need the baby PIX. 53

HA Outside Main Firewall n n Firewall between MR interfaces and public Internet as well as the HA and Private Intranet. Reverse tunneling required as requests from MR LAN hosts must pass through Proxy inside main firewall. 54

Areas that need to be addressed n Home Agent Placement n n AAA Issues n n n Open Radio Access / Restricted Network Access Secure Key Management IPv 6 Mobile Networking Development n n Inside or Outside the Firewall Work with industry and IETF Develop radio link technology n Enable better connectivity throughout the world for both military and aeronautical communications (voice, video and data). 55

Relevant NASA Aeronautics Programs n n n Advanced Air Transportation Technology (AATT) Weather Information Communication (WINCOMM) Small Aircraft Transportation System (SATS) 56

Aeronautic Networking Issues n Move to IPv 6 n n n IPv 6 Mobile Networking Authentication, Authorization and Accounting Bandwidth, Bandwidth Media Access Policy n Sending of Operations over Entertainment Channels 57

IPv 6 Mobile-IP 58

Mobile-IPv 6 n n n No "foreign agent“ routers Route optimization is a fundamental part of the protocol Mobile IPv 6 route optimization can operate securely even without pre-arranged security associations Route optimization coexists efficiently with routers that perform "ingress filtering" The movement detection mechanism in Mobile IPv 6 provides bidirectional confirmation of a mobile node's ability to communicate with its default router in its current location Most packets sent to a mobile node while away from home in Mobile IPv 6 are sent using an IPv 6 routing header rather than IP encapsulation 59

IPv 6 60

Options Examples Fragmentation Header Authentication Header 61

Mobility Header n Extension header used by mobile nodes, correspondent nodes, and home agents in all messaging related to the creation and management of bindings 62

Mobility Message Types n n n n Binding Refresh Request Message Home Test Init Message Care-of Test Init Message Home Test Message Care-of Test Message Binding Update Message Binding Acknowledgement Message Binding Error Message 63

Mobility Options n n n n Pad 1 Pad. N Binding Refresh Advice Alternate Care-of Address Nonce Indices Binding Authorization Data Home Address Option Type 2 Routing Header 64

Mobile-IPv 6 n Modes for communications between the mobile node and a correspondent node n Bidirectional tunneling n n Does not require Mobile IPv 6 support from the correspondent node “Route Optimization“ n n Requires the mobile node to register its current binding at the correspondent node. Packets from the correspondent node can be routed directly to the care-of address of the mobile node 65

Mobile-IPv 6 using Reverse Tunneling Mobile Node “ ” Access Router Internet or Intranet Corresponding Node Home Agent 66

Mobile-IPv 6 using Route Optimization Mobile Node “ ” Access Router Internet or Intranet Corresponding Node Home Agent 67

Mobile-IPv 6 Binding Updates Access Router Mobile Node “ ” x P U k The number of Lin Binding Updates is A Scalability Problem for Mobile Networks Access Router Internet or Intranet Corresponding Node Home Agent 68

Mobile IPv 6 Security n n n Binding Updates use IPsec extension headers, or by the use of the Binding Authorization Data option Prefix discovery is protected through the use of IPsec extension headers Mechanisms related to transporting payload packets - such as the Home Address destination option and type 2 routing header have been specified in a manner which restricts their use in attacks 69

NEMO NEtworks in Motion http: //www. ietf. org/html. charters/nemo-charter. html http: //www. nal. motlabs. com/nemo/ 70

Networks In Motion (NEMO) n n Working Group established in IETF in December 2002 Concerned with managing the mobility of an entire network, which changes, as a unit, its point of attachment to the Internet and thus its reachability in the topology. 71

Goals n n Standardizing some basic support mechanisms based on the bidirectional tunneling approach Study the possible approaches and issues with providing more optimal routing 72

Milestones n n n MAR 03 Submit terminology and requirements documents (for Basic support). MAY 03 Submit Threat analysis and security requirements for NEMO. AUG 03 Submit solution for basic support NOV 03 Submit MIB for Basic support MAR 04 Submit the analysis of the solution space for route optimization JUN 04 Shut down or recharter the WG to solve the route optimization 73

draft-ietf-nemo-requirements-00. txt n n n n The basic solution MUST use bi-directional tunnels MNNs MUST be reachable at a permanent IP address and name. MUST maintain continuous sessions (both unicast and multicast) between MNNs and arbitrary CNs after IP handover of (one of) the MR. The solution MUST not require modifications to any node other than MRs and HAs. The solution MUST support fixed nodes, mobile hosts and mobile routers in the mobile network. The solution MUST not prevent the properation of Mobile IPv 6 (i. e. the solution MUST support MIPv 6 -enabled MNNs and MUST also allow MNNs to receive and process Binding Updates from arbitrary Mobile Nodes. ) The solution MUST treat all the potential configurations the same way (whatever the number of subnets, MNNs, nested levels of MRs, egress interfaces, . . . ) The solution MUST support mobile networks attaching to other mobile networks (nested mobile networks). 74

Not Yet required n n Route Optimization Load Sharing Policy Based Routing Multiple Home Agents from different Service Providers n n Security Issues Desirable for some applications (i. e. air traffic control, airline maintenance, entertainment) 75

Basic Mobile Network Support for IPv 6 Mobile Network Binding Nodes Update Mobile Network P Access Router U k n i L x Access Router Internet or Intranet Corresponding Node Home Agent 76

NEMO Experiments IPv 4 & IPv 6 77

78

79

Mobile Router Corresponding Public Node ENCRYPTOR Secure Mobile LAN Public Internet PROXY ENCRYPTOR Home Agent Private Intranet Corresponding Private Node 80

Mobile Router Corresponding Public Node ENCRYPTOR Secure Mobile LAN Public Internet PROXY ENCRYPTOR Home Agent Private Intranet Corresponding Private Node 81

Corresponding Public Node Public Internet PROXY ENCRYPTOR Home Agent Private Intranet Corresponding Private Node ENCRYPTOR Secure Mobile LAN Mobile Router 82

Corresponding Public Node Proxy blocks Communication Initiated outside the Firewall Public Internet x PROXY ENCRYPTOR Home Agent Private Intranet Corresponding Private Node ENCRYPTOR Secure Mobile LAN Mobile Router 83

Corresponding Public Node Public Internet PROXY ENCRYPTOR Home Agent Private Intranet Corresponding Private Node ENCRYPTOR Secure Mobile LAN Mobile Router 84

85

86

Additional Possibilities n n Joint work with Eurocontrol Wireless Cabin work being performed by European Consortium using IPv 6 87

NASA’s Space-Based Needs Mobile Networks 88

Earth Observation T 3 T 1 T 2 ? 89

90

Space Flight Implementation n Sharing Infrastructure n n n Common Media Access Common Ground Terminal Capabilites Common Network Access n n AAA Common Modulation and Coding n Software Radio 91

Backup 92

Neah Bay 93

Layer 2 Technology Globalstar MCM-8 L 3 -Comm 15 d. Bic Tracking Antenna Hypergain 802. 11 b Flat Panel 8 d. Bi Dipole Sea Tel Tracking Antenna 94

Satellite Coverage Globalstar INMARSAT From Sa. Vi 95

Papers and Presentations http: //roland. grc. nasa. gov/~ivancic/papers_presentations/papers. html or http: //roland. grc. nasa. gov/~ivancic/ and pick “Papers and Presentations” 96