HIPandHIPmiddlebox福建工程学院现代教育技术中心

HIP register extension

HIP register extension

System framework

FW-R
I1 R1’
发
I2’ R2’ I1
中 间 系 统
响
I1 I2 FW-I
起
端
I2 SPI(I),SPI(R)

Data header compression

HIP base exchange

HIP UPDATE Procedure :
What is HIP

HIP and Middleboxes
Motivation for HIP

Simple mobility example:
Remote Node
Access Router 1
Access Router 2
ADDR1
Mobile node
Motivation for HIP


目录
1
2 3
Motivation for HIP
What is HIP?
HIP and Middleboxes
4
Conclusion
Fujian univerLeabharlann ity of technology
Motivation for HIP

IP serves dual role in the internet: Locator Identifier
reference

1. 2. 3. 4. 5. 6. 7. 8.
Ylitalo, J., Melen, J., Nikander, P. and V. Torvinen, "Re-thinking Security in IP based MicroMobility", 7th Information Security Conference (ISC-04), Palo Alto,", September 2004. Moskowitz, R., Nikander, P., Jokela, P. and T. Henderson: "Host Identity Protocol",draft-ietfhip-base-00.txt (work in progress),June 2004 Aboba B. and DixonW., IPsec-Network Address Translation (NAT) Compatibility Requirements RFC 3715, March 2004. H. Tschofenig., " draft-tschofenig-hiprg-hip-natfw-traversal-06.txt", (work in progress), July 9, 2007 A. Huttunen et al, A., "UDP Encapsulation of IPsec Packets", draft-ietf-ipsec-udp-encaps07.txt (work in progress), Jan 2003. J. Laganier., " draft-ietf-hip-registration-02.txt", (work in progress), June 7, 2006. H. Tschofenig,A. Nagarajan,Siemens,et al.NAT and Firewall Traversal for HIP draft-tschofenighiprg-hip-natfw-traversal-00.txt.October 18, 2004 E. Rescorla., Diffie-Hellman Key Agreement Method RFC 2631, June 1999

Host Identities (Public key of a key pair) Host Identity Tags (128 bits)
IP addresses as locators An authentication and key exchange protocol IPsec ESP transport mode for data traffic security.
What is HIP

HIP Layering Model:
What is HIP

HIP header :
What is HIP

The double lookup mechanism :
HIP base exchange
源：家乡代理地址 目的：外地代理地址
移动节点
Motivation for HIP

三角路由问题
通信对端
家乡代理
外地代理
三角路由问题
移动节点
Motivation for HIP

Security problem
攻击者能够监听到移动节点的 数据包

Problem with Routing Asymmetry


Asymmetric paths Interception, as previously described, is not possible: Firewall(I) needs to know SPI(I) Firewall(R) needs to know SPI(R)
Motivation for HIP

绑定注册
通信对端
家乡代理 ③注册应答 ②注册请求
外地代理
移动节点
Motivation for HIP

接收/发送分组
通信对端
代理ARP和 免费ARP
家乡代理 分组 隧道
外地代理
IP数据 IP头标 家乡代理处 IP-in-IP封装 IP数据 IP头标 外地代理处 IP-in-IP解封装 IP头标

MIPv4：使用外地代理转交地址
移动检测
Remote Node
Home Agent
Foreign Agent
Mobile Node
Motivation for HIP

移动检测
通信对端
家乡代理
外地代理
使用外地代理 转交地址
Mobile Node
攻击 者
移动节 点
家乡代 理 HoTI HoT
CoTI CoT
通信对 端
攻击者在家乡网络和通信对端 的路径上 获得绑定管理密钥，伪造绑 定更新等
移动节 点
家乡代 理 HoTI CoTI CoT HoT 攻击 者 通信 对端
What is HIP

HIP: Host Identify Protocol (RFC 4423) New cryptographic identifiers
使用外地代理转交地址wwwfjuteducnmobilenode移动检测使用外地代理转交地址motivationhip家乡代理通信对端外地代理wwwfjuteducn绑定注册家乡代理通信对端移动节点外地代理注册请求注册应答motivationhipwwwfjuteducn接收发送分组家乡代理通信对端移动节点外地代理代理arp和免费arp隧道ip数据ip头标ip数据ip头标ip头标家乡代理处ipinip封装外地代理处ipinip解封装源
应
R1 R1’ I2’ R2’ R1 R2 SPI(I),SPI(R)
R1 R2
中 间 系 统
端
Consideration of security

HIP Cookies
预先产生随机数I ; 谜题的难度系数K是可调整的; 难题解答与验证的难度不对称;
Diffie-Hellman密钥交换机制
Remote Node
Access Router 1
Access Router 2
ADDR2
Mobile Node
不中断已经建立的连接
IP地址的改变对于通信对端和上层 （IP层以上）是透明的 移动节点需要一个在移动过程中 保持不变的标识
家乡地址
通信对端始终能够找到移动节点
Motivation for HIP