Subject: Re: [MOBILE-IP] MIPv6 node location detection

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Thu, 19 Oct 2000 16:33:05 -0500

I am new to this list and MIP in general and v6 in particular, so I am sorry if there has been a thread about this in the past. A pointer to a place to read is fine with me too.
My question concerns the security of this scenario:
The home link changes it's prefix and starts sending router advertisement messages, we are trying to find a solution by which the mobile need to recognize that it has not moved and it is just its old Home link with a new address. What if we all of a sudden had a malicious attacker, who starts sending router advertisement with bogus new home addresses(assuming it has brought the home router down through some DoS attack in the mean time) and pretending to be the home router. As far as I understand the router advertisements are not authenticated. Wouldn't all the mobile nodes getting services in that area be confused for a while. Is there a restriction on who can send RAs?
Does there have to be some kind of security association that need to be established before somebody can send a router advertisement?
I guess if we choose to send info on both the old and the new address in the advertisement it helps, but I do not how much?

Thanks,

Madjid Nakhjiri

-----Original Message-----
From: John F. Leser [mailto:[email-masked]]
Sent: Friday, October 13, 2000 9:14 AM
To: [email-masked]
Subject: Re: [MOBILE-IP] MIPv6 node location detection

On Sat, 14 Oct 2000, Hesham Soliman (EPA) wrote:

> > What is the difference between two advertisement below ?
> >       - Renumbered home link router advertisement
> >       - Router advertisement in a foreign link
> >
> > My question is why the mobile node don't just add the new address
> > in MN's address list. How do the MN decide whether it start MIPv6
> > process or autoconfiguration process for renumbered home link address.
> > What if the all home addresses in the list have expired before the MN
> > get FA's router advertisement, can the MN still use the expired address
> > record
> > in it's system ?
> >
>         => I think you're certainly asking the right question but
>         perhaps to the wrong mailing list :)
>         If I understand you correctly, you're saying that while the
>         MN is at Home, if a new advertisement is received with a new
>         prefix, how does it know that this is not another foreign subnet.
>         Well based on my rusty knowledge  of ND and stateless address
>         configuration, it doesnt know. But I don't think that this is
> strictly
>         a MIP issue. While you're at home MIP does not do anything
>         for  you. So that's why I'll cc IPng on this to see if someone can
>         give you a better answer, or maybe I missed something here.
>         BTW FA's do not exist in MIPv6.
>

Reading through section 10.4 of the MIPv6 draft (version 12), I get the
impression that:

1. Movement detection is not a simple problem to solve.  The draft
doesn't really specifiy what method should be used.

2. Seeing an adverisement from a router with a different prefix is not a
good way to detect movement.  The preferred movement detection method
seems to be loss of reachability of the MN's default router, which is
noticed through neighbor unreachability detection and/or use of the
router advertisement interval option.

>
>
>
>
> > I also can't find RFC or draft which define exactly address list in a
> > MIPv6 MN. A IPv6 node have a address list and  every prefix has lifetime.
> > Please give me some advice on it.
> >
> >
> >
>

You may want to take a look at section 5.2 of RFC 2462, which mentions the
address list.  I hope this is helpful.

-------------------------------------------------------------------
John Leser                      UNH InterOperability Lab
IP/Routing Consortium Engineer  Morse Hall, 39 College Rd, Room 332
Tel: (603) 862-0090 (8-5 EST)   Durham, NH 03824-3525
Fax: (603) 862-1761             Web: www.iol.unh.edu
-------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Fri, 20 Oct 2000 14:38:39 +0200

Please look at Link-shared secrets for ND presented by D. McDonald
in March at the IETF meeting in Adelaide (to protect ND with IPsec
will improve many things but a good way to spread secrets is needed).

Regards

[email-masked]