Nowadays, security has been the one of the most challenge in any network. Mobile IP allows mobile users to change their network attachment frequently without loosing their continuous connection, which gives many advantages to users. However, the mobility of communication devices and characteristics of the wireless channel introduce many of security issues. Security issues for mobile IP considered when the mobile device register it is care-of address to the home agent, this registration messages required an Authentication. In this chapter will introduce the common security threats that faced mobile IP networks as well as the method and suggestion to improve the security performance of mobile IP.
5.1 Security issues with mobile IP
5.1.1 A Denial-of-Service Attack
A Denial-of-service attack (DoS) is raised up once the attackers prevent the authorized users from getting their work done . This kind of attack usually takes the following steps:
By sending a large number of requests over the internet. These many requests make the target device to run below the optimum speeds till it become unavailable.
Get your grade
or your money back
using our Essay Writing Service!
The other way is to intercept the communication between two devices on the network directly. For example, attacker can use the techniques of redirection to make the data not reaching the authorized user forever.
In the case of Mobile IP the denial of service attack happened once attacker start to manipulate of the registration of a care of address for particular mobile device, figure 5.1 illustrated Denial of Service's manipulated registrations. Such a manipulate registration lead to two issues:
The Mobile device is no longer connected
The attacker get all traffic directed to the original mobile device.
Figure 5.1 - Denial of Service attack to a Mobile IP network
In this kind of attack, the attacker generally needs to be in the middle between the two corresponding hosts in order to cut off their traffic. But with Mobile IP network, the attacker can attack the network from any where, if a mobile device is connected on the foreign network, it is mandatory to use the registration method to inform its home agent of its current care-of address to which home agent will intercept and tunnel all the traffic destined to the mobile device's home address. So attacker can generate a manipulated register request message declaring with his own IP address as the care-of address for a mobile device to the home agent. So all traffic transmitted to the Mobile device go to the attacker (Bad Guy) instead. In order to protect the Mobile network from this kind of attacks, strong authentications are required in all registration traffic exchange by a mobile device and its home IP agent.
Authentication mechanism insure that that traffic is going to the mobile device who should to receive it, not any body else. Mobile IP allows a mobile device and home agent to use and agree with any authentication algorithms they agreed to. However, all implementation of mobile IP support the default algorithm MD5 which can provide the strong authentication that needed.
5.1.2 Passive Eavesdropping
Passive Eavesdropping is type of a theft of information attack. A passive eavesdropping attack happened when attacker start to listen to the traffic that is transfer between mobile device and its home agent.
Attacker in passive eavesdropping needs to access to the traffic in order this to happen; this can happen in different ways. An attacker can get access to a network and connect a host to the network. In case of a shared Ethernet, all traffic on the same segment may be a victim of eavesdropper. Some time if the thief is able to receive packet that transmitted by radio signals if he is close enough of the wireless network.
In order to prevent eavesdropping in mobile IP it is required to use encryption method to encrypt all ongoing traffic information. This can be done in several ways. Traffic should be encrypted on the foreign link, so the attacker can't decode and understand the cipher text and eavesdropping can no longer happened on the foreign link. Although, the traffic still might be a victim of eavesdropping on the rest of end to end connection.
Always on Time
Marked to Standard
The best solution would be to use the end to end encryption method on all traffic, this make the eavesdropping attacks impossible.
5.1.3 Reply Attack
Using Authentication, a mobile device can prevent the denial of service attack as we mention in the previous sections. However it can not protect mobile device from reply attack, because attacker can have a copy of valid registration request message, buffer it, and then reply it later on by registering a manipulated care-of address for the mobile device.
To prevent this kind of attack, the mobile device has to generate a unique value for identification field of each successful attempt of registration. By this way, the stored registration request message by the attacker will be defined as out of date from the home agent respective. Mobile IP defined two ways to set identification field. The first one uses timestamp, where the mobile device use an estimate date and time of date by in the identification field. The second method uses a random number. In this method, the mobile device and home agent declare the value which is entered in the identification field accordingly. A message will be rejected if either device receive a registration message with identification field does not match the expected value and this message will be ignored in the case of mobile device.
5.1.4 Session Stealing
Session Stealing is type of a theft of information attack as same as Passive Eavesdropping, but in different steps:
The attacker waits for mobile device to authenticate and register with its home agent and starts application sessions.
The attacker eavesdrops to see when the mobile device any interesting conversation traffic comes through.
Then the attacker floods mobile device with malicious packets.
The attacker steals the session by intercepting the packet that is going to the mobile device then the attacker send their own packets that appearing to have come from the mobile device.
The user of the mobile device might not notice that the session has been stolen because there is no sign showing something like this has happened. The protection against Session stealing is the same as passive eavesdropping by providing end to end encryption with authentication.
5.1.5 Tunnel Spoofing
The tunnel to the home network or foreign network may be used to hide the malicious packets and get them pass through the firewall.
As registration method is a key role of mobile IP, Mobile IP has some basic security solutions. Mobile IP requires authentication for registration method between mobile device and home agent. Moreover, Mobile IP uses identification field and timestamp to protect registration from any attacks.
5.2 Security Models
In order to secure the protocol, two approaches can be used:
5.2.1 Weak Security Approach
Weak level of security may be agreed between users in environment such as "campus", since these services are not high added value or not primarily of commercial nature. A protection against manipulated attempts such as:
Home Agent assuredly considers the care-of address of mobile device is correct, because the allowed care-of address concern to well known IP address.
The mobile device in the foreign network has to authenticate bindings.
When a mobile device attached to the foreign network , it sends a registration request with password to the home agent.
5.2.2 Strong Security Approach
The weak security approach that discussed in the previous section is not suitable any more. Both now have to agree on the stronger level of security policy where mobile IP authenticates of any binding message or authenticate information received about a mobile device. Trusted servers and private and public keys are used, but it slows down the operation.
5.3 Method and Suggestion on improving the security of Mobile IP
5.3.1 Using Tunneling instead of Source Routing:
The main purpose of using tunneling techniques instead of source routing is that tunneling relate to less security threats. Attacker can use a manipulated care-of address as a destination in a loose source route. This will make the correspondent node to reverse the source route and send the message to the manipulated care of address. So the mobile device is disconnected from communicating with his correspondent node. This issue can be solved by proper use of authentication.
5.3.2 Avoiding Route Optimization:
This Essay is
a Student's Work
This essay has been submitted by a student. This is not an example of the work written by our professional essay writers.Examples of our work
When a mobile device is communicating with a correspondent node from a foreign network all its packets must be forwards through its home agent, this called triangle routing that can results in degrading in significant performance. Route optimization to mobile IP which is recently proposed allow the home agent to inform the correspondent node with mobile device's care of address, thus correspondent node can communicate directly with mobile device without passing the home agent, which results in less delay and resource consumption. However the main issue with route optimization is the security. A network administrator configures a secret key to authenticate between the mobile device and its correspondent node, but with a large numbers of mobile devices, it is not practical to configure keys between a mobile device and every other correspondent node. In the case of triangle routing, it's convincible to configure a key between mobile device and its home agent. So for this reason we suggest to keep using triangle routing.
5.3.3 Using Firewall:
A firewall is used to prevent unwanted access to network services. The firewall monitors the traffic going through the network and decide on the basis defined rules whether certain Network packets are allowed through or not. In this way it tries to network firewall to prevent unauthorized access. Typically, a firewall can not prevent the exploitation of vulnerability in the network service if the communication partner can access it. There are several kinds of firewall, mainly including the following three categories:
Packet filtering: It is the oldest network filtering device, introduced on the routers. And the simple filtering data packet that uses the network addresses as basic function of the firewall. It looks at each packet independently and compares it to a list of preconfigured rules. The issue with packet filtering is that it's hard to configure correctly and they can't keep private IP address invisible to the public IP address.
Stateful Inspection: This stateful filtering is an advanced form of packet filtering. This makes it possible to access an established connection to restrict specific and thus better protect the internal network from unwanted external access
Proxy filter: A proxy firewall is a firewall which is based Dedicated Proxy and Circuit Level Proxy recourse as filter modules. These filter modules are implementing rules by deciding what data to the actual communication party are transferred, and what not. In this way it tries to proxy firewall's own network (segment) to protect against unauthorized access, but can also make a conversion of the data cache certain content, and exercise all other functions that are peculiar to a proxy.
In summary, we can say that firewalls provide a good security and flexibility for mobile IP by using the above firewall category that described above.
5.3.4 Implementing IPSec as a solution to security issues in Mobile IP:
IPSec (Internet Security protocol) is Defined by IETF as a framework of open standards for ensuring private communications over IP networks protected by the use of cryptographic security services .It is a set of protocols using algorithms to secure data transport over a network IP. IPSec is different from previous security standards not being limited to a single authentication method or algorithm and that is why he is considered a part of open standards. Over IPSec operates at the network layer (layer 3 OSI) Contrary to the standards that operated prior to the application layer (layer 7 of OSI), Which makes it independent of the applications, and means that users do not need to configure each application to standard IPSec.
In the next chapter will discuss in detail how IPSec works and what the issues does it handle and how can it solve these problems