Mobile IPv6 Operation with IKEv2 and the Revised IPsec Architecture
How Mobile IPv6 signalling is protected with the revised IPsec architecture and IKEv2.
Devarapalli, V. and F. Dupont, "Mobile IPv6 Operation with IKEv2 and the Revised IPsec Architecture", RFC 4877, DOI 10.17487/RFC4877, April 2007, <https://www.rfc-editor.org/info/rfc4877>.
@misc{rfc4877,
series = {Request for Comments},
number = 4877,
howpublished = {RFC 4877},
publisher = {RFC Editor},
doi = {10.17487/RFC4877},
url = {https://www.rfc-editor.org/info/rfc4877},
author = {V. Devarapalli and F. Dupont},
title = {{Mobile IPv6 Operation with IKEv2 and the Revised IPsec Architecture}},
pagetotal = 26,
year = 2007,
month = apr,
} RFC text
Contents
Network Working Group V. Devarapalli
Request for Comments: 4877 Azaire Networks
Updates: 3776 F. Dupont
Category: Standards Track CELAR
April 2007
Mobile IPv6 Operation with IKEv2 and the Revised IPsec Architecture
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The IETF Trust (2007).
Abstract
This document describes Mobile IPv6 operation with the revised IPsec
architecture and IKEv2.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Packet Formats . . . . . . . . . . . . . . . . . . . . . . . . 4
4. Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 4
4.1. General Requirements . . . . . . . . . . . . . . . . . . . 5
4.2. Policy Requirements . . . . . . . . . . . . . . . . . . . 5
4.3. IPsec Protocol Processing Requirements . . . . . . . . . . 7
4.4. Dynamic Keying Requirements . . . . . . . . . . . . . . . 9
5. Selector Granularity Considerations . . . . . . . . . . . . . 10
6. Manual Configuration . . . . . . . . . . . . . . . . . . . . . 11
6.1. Binding Updates and Acknowledgements . . . . . . . . . . . 12
6.2. Return Routability Messages . . . . . . . . . . . . . . . 13
6.3. Mobile Prefix Discovery Messages . . . . . . . . . . . . . 14
6.4. Payload Packets . . . . . . . . . . . . . . . . . . . . . 14
7. Dynamic Configuration . . . . . . . . . . . . . . . . . . . . 15
7.1. Peer Authorization Database Entries . . . . . . . . . . . 15
7.2. Security Policy Database Entries . . . . . . . . . . . . . 15
7.2.1. Binding Updates and Acknowledgements . . . . . . . . . 16
7.2.2. Return Routability Messages . . . . . . . . . . . . . 17
7.2.3. Mobile Prefix Discovery Messages . . . . . . . . . . . 17
7.2.4. Payload Packets . . . . . . . . . . . . . . . . . . . 18
7.3. Security Association Negotiation Using IKEv2 . . . . . . . 18
7.4. Movements and Dynamic Keying . . . . . . . . . . . . . . . 20
8. The Use of EAP Authentication . . . . . . . . . . . . . . . . 21
9. Dynamic Home Address Configuration . . . . . . . . . . . . . . 22
10. Security Considerations . . . . . . . . . . . . . . . . . . . 23
11. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 24
12. References . . . . . . . . . . . . . . . . . . . . . . . . . . 24
12.1. Normative References . . . . . . . . . . . . . . . . . . . 24
12.2. Informative References . . . . . . . . . . . . . . . . . . 24
1. Introduction
RFC 3776 describes how IPsec, as described in RFC 2401 [11], is used
with Mobile IPv6 [2] to protect the signaling messages. It also
illustrates examples of Security Policy Database and Security
Association Database entries that can be used to protect Mobile IPv6
signaling messages.
The IPsec architecture has been revised in RFC 4301 [5]. Among the
many changes, the list of selectors has been expanded to include the
Mobility Header message type. This has an impact on how security
policies and security associations are configured for protecting
mobility header messages. It becomes easier to differentiate between
the various Mobility Header messages based on the type value instead
of checking if a particular mobility header message is being sent on
a tunnel interface between the mobile node and the home agent, as it
was in RFC 3776. The revised IPsec architecture specification also
includes ICMP message type and code as selectors. This makes it
possible to protect Mobile Prefix Discovery messages without applying
the same security associations to all ICMPv6 messages.
This document discusses new requirements for the home agent and the
mobile node to use the revised IPsec architecture and IKEv2.
Section 4 lists the requirements. Sections 6 and 7 describe the
required Security Policy Database (SPD) and Security Association
Database (SAD) entries.
The Internet Key Exchange (IKE) protocol has also been substantially
revised and simplified [4]. Section 7.3 of this document describes
how IKEv2 can be used to set up security associations for Mobile
IPv6.
The use of EAP within IKEv2 is allowed to authenticate the mobile
node to the home agent. This is described in Section 8. A method
for dynamically configuring a home address from the home agent using
the Configuration Payload in IKEv2 is described in Section 9.
2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [1].
3. Packet Formats
The mobile node and the home agent MUST support the packet formats as
defined in Section 3 of RFC 3776.
In case the mobile node reverse tunnels all traffic including Mobile
IPv6 signaling messages exchanged between the mobile node and the
home agent, then the Home Address Option is not required to be
present in the messages sent to the home agent. The packet format
for the binding update when sent in the tunnel mode looks as follows.
IPv6 hdr (source = care-of address,
destination = home agent)
ESP header in tunnel mode
IPv6 hdr (source = home address,
destination = home agent)
Mobility Header
Binding Update
Alternate Care-of Address option (care-of address)
The binding acknowledgement sent to the mobile node when it is away
from the home link looks as follows.
IPv6 hdr (source = home agent,
destination = care-of address)
ESP header in tunnel mode
IPv6 hdr (source = home agent,
destination = home address)
Mobility Header
Binding Acknowledgement
The packet formats for tunneled mobile prefix discovery messages are
very similar to the tunneled Binding Update and Binding
Acknowledgment with the with the home address as the source address
in the inner IP header.
The support for the above tunneled packet format is optional on the
mobile node and the home agent.
4. Requirements
This section describes mandatory rules and requirements for all
Mobile IPv6 mobile nodes and home agents so that IPsec, with IKEv2 as
the key management protocol, can be used to protect traffic between
the mobile node and the home agent. Many of the requirements are
repeated from RFC 3776 to make this document self-contained and
complete.
4.1. General Requirements
o RFC 3775 states that manual configuration of IPsec security
associations MUST be supported, and automated key management MAY
be supported. This document does not make any recommendations
regarding the support of manual IPsec configuration and dynamic
IPsec configuration. This document just describes the use of
manually created IPsec security associations and the use of IKEv2
as the automated IPsec key management protocol for protecting
Mobile IPv6 signaling messages.
o ESP encapsulation for Binding Updates and Binding Acknowledgements
MUST be supported and used.
o ESP encapsulation in tunnel mode for the Home Test Init (HoTi) and
Home Test (HoT) messages tunneled between the mobile node and the
home agent MUST be supported and SHOULD be used.
o ESP encapsulation of the ICMPv6 messages related to mobile prefix
discovery MUST be supported and SHOULD be used.
o ESP encapsulation of the payload packets tunneled between the
mobile node and the home agent MAY be supported and used.
o If multicast group membership control protocols or stateful
address autoconfiguration protocols are supported, payload data
protection MUST be supported for those protocols.
o The home agent and the mobile node MAY support authentication
using EAP in IKEv2 as described in Section 8.
o The home agent and the mobile node MAY support remote
configuration of the home address as described in Section 9. When
the home agent receives a configuration payload with a CFG_REQUEST
for INTERNAL_IP6_ADDRESS, it must reply with a valid home address
for the mobile node. The home agent can pick a home address from
a local database or from a DHCPv6 server on the home link.
4.2. Policy Requirements
The following requirements are related to the configuration of the
security policy database on the home agent and the mobile node.
o RFC 3776 required configuration of the security policies per
interface in order to be able to differentiate between mobility
header messages sent to the home agent and those tunneled through
the home agent to the correspondent node. Since the Mobility
Header message type is a selector, it is now easy to differentiate
between HoTi and HoT messages from other mobility header messages.
Therefore per-interface configuration of security policies is not
required for protecting mobility header messages. Note that
without per-interface security policies, payload packet protection
is limited to packets originating/terminating at the home address.
Traffic using a link local address within the Mobile IP tunnel
cannot be provided IPsec protection without per-interface security
policies.
o The home agent MUST be able to prevent a mobile node from using
its security association to send a Binding Update on behalf of
another mobile node. With manual IPsec configuration, the home
agent MUST be able to verify that a security association was
created for a particular home address. With dynamic keying, the
home agent MUST be able to verify that the identity presented in
the IKE_AUTH exchange is allowed to create security associations
for a particular home address.
o The home agent uses the Peer Authorization Database (PAD) [5] to
store per-mobile node state. More specifically the per-mobile
state stores information that is used to authenticate the mobile
node and the authorization information that ties the mobile node's
identity to the home address of the mobile node. This will allow
the home agent to prevent a mobile node from creating IPsec
security associations for another mobile node's home address. In
case of dynamic home address assignment, the home agent creates a
temporary PAD entry linking the authenticated peer identity and
the newly allocated home address.
o As required in the base specification [2], when a packet destined
to the receiving node is matched against IPsec security policy or
selectors of a security association, an address appearing in a
Home Address destination option is considered as the source
address of the packet.
Note that the home address option appears before IPsec headers.
Section 11.3.2 of the base specification describes one possible
implementation approach for this: The IPsec policy operations can
be performed at the time when the packet has not yet been modified
per Mobile IPv6 rules, or has been brought back to its normal form
after Mobile IPv6 processing. That is, the processing of the Home
Address option is seen as a fixed transformation of the packets
that does not affect IPsec processing.
o Similarly, a home address within a Type 2 Routing header destined
to the receiving node is considered as the destination address of
the packet, when a packet is matched against IPsec security policy
or selectors of a security association.
Similar implementation considerations apply to the Routing header
processing as was described above for the Home Address destination
option.
o When the mobile node returns home and de-registers with the Home
Agent, the tunnel between the home agent and the mobile node's
care-of address is torn down. The security policy entries, which
were used for protecting tunneled traffic between the mobile node
and the home agent, SHOULD be made inactive (for instance, by
removing them and installing them back later through an API). The
corresponding security associations could be kept as they are or
deleted depending on how they were created. If the security
associations were created dynamically using IKE, they are
automatically deleted when they expire. If the security
associations were created through manual configuration, they MUST
be retained and used later when the mobile node moves away from
home again. The security associations protecting Binding Updates,
Binding Acknowledgements and Mobile Prefix Discovery messages
SHOULD NOT be deleted as they do not depend on care-of addresses
and can be used again.
o The mobile node MUST use the Home Address destination option in
Binding Updates and Mobile Prefix Solicitations when transport
mode IPsec protection is used, so that the home address is visible
when the IPsec policy checks are made.
o The home agent MUST use the Type 2 Routing header in Binding
Acknowledgements and Mobile Prefix Advertisements sent to the
mobile node when transport mode IPsec protection is used, again
due to the need to have the home address visible when the policy
checks are made.
4.3. IPsec Protocol Processing Requirements
The following lists requirements for IPsec processing at the Home
Agent and the mobile node.
o The home agent and mobile node SHOULD support Mobility Header
message type as an IPsec selector.
o The home agent and mobile node SHOULD support ICMPv6 message type
as an IPsec selector.
o The home agent MUST be able to distinguish between HoTi messages
sent to itself (when it is acting as a Correspondent Node) and
those sent to Correspondent Nodes (when it is acting as a home
agent) based on the destination address of the packet.
o When securing Binding Updates, Binding Acknowledgements, and
Mobile Prefix Discovery messages, both the mobile node and the
home agent MUST support the use of the Encapsulating Security
Payload (ESP) [6] header in transport mode and MUST use a non-null
payload authentication algorithm to provide data origin
authentication, connectionless integrity, and optional anti-replay
protection. The use of sequence number in the ESP header to
provide anti-replay protection is optional because the sequence
numbers in the Binding Updates provide anti-replay protection.
However, the anti-replay protection fails if the home agent loses
the binding cache state, for example, due to a reboot. Since the
IPsec security association state can also be assumed to be lost,
ESP cannot provide anti-replay protection in this case. Complete
anti-replay protection can only be provided by the use of a
dynamic keying mechanism, like IKEv2.
Support for protecting these messages using ESP in tunnel mode is
optional.
o Tunnel mode IPsec ESP MUST be supported and SHOULD be used for the
protection of packets belonging to the return routability
procedure. A non-null encryption transform and a non-null
authentication algorithm MUST be applied.
o When ESP is used to protect Binding Updates, there is no
protection for the care-of address that appears in the IPv6 header
outside the area protected by ESP. It is important for the home
agent to verify that the care-of address has not been tampered
with. As a result, the attacker would have redirected the mobile
node's traffic to another address. In order to prevent this,
Mobile IPv6 implementations MUST use the Alternate Care-of Address
mobility option in Binding Updates sent by mobile nodes while away
from home. The exception to this is when the mobile node returns
home and sends a Binding Update to the home agent in order to de-
register.
When IPsec is used to protect return routability signaling or
payload packets, the mobile node MUST set the source address it
uses for the outgoing tunnel packets to the current primary
care-of address.
o When IPsec is used to protect return routability signaling or
payload packets, IPsec security associations are needed to provide
this protection. When the care-of address for the mobile node
changes as a result of an accepted Binding Update, special
treatment is needed for the next packets sent using these security
associations. The home agent MUST set the new care-of address as
the destination address of these packets, as if the outer header
destination address in the security association had changed.
Similarly, the home agent starts to expect the new source address
in the tunnel packets received from the mobile node.
Such address changes can be implemented, for instance, through an
API from the Mobile IPv6 implementation to the IPsec
implementation. One such API is described in [12]. It should be
noted that the use of such an API and the address changes MUST
only be done based on the Binding Updates received by the home
agent and protected by the use of IPsec. Address modifications
based on other sources, such as Binding Updates to the
correspondent nodes protected by return routability, or open
access to an API from any application may result in security
vulnerabilities.
4.4. Dynamic Keying Requirements
The following requirements are related to the use of a dynamic key
management protocol by the mobile node and the home agent.
Section 7.3 describes the use of IKEv2 as the dynamic key management
protocol.
o The mobile node MUST use its care-of address as source address in
protocol exchanges, when using dynamic keying.
o The mobile node and the home agent MUST create security
associations based on the home address, so that the security
associations survive changes in care-of address. When using IKEv2
as the key exchange protocol, the home address should be carried
as the initiator IP address in the TSi payload during the
CREATE_CHILD_SA exchange [4].
o If the mobile node has used IKEv2 to establish security
associations with its home agent, it should follow the procedures
discussed in Sections 11.7.1 and 11.7.3 of the base specification
[2] to determine whether the IKE endpoints can be moved or if the
SAs, including the IKEv2 SA, have to be re-established.
o If the home agent has used IKEv2 to establish security
associations with the mobile node, it should follow the procedures
discussed in Section 10.3.1 and 10.3.2 of the base specification
[2] to determine whether the IKE endpoints can be moved or if the
SAs, including the IKEv2 SA, have to be re-established.
5. Selector Granularity Considerations
IPsec implementations are compatible with this document even if they
do not support fine-grain selectors such as the Mobility Header
message type and ICMPv6 message type. Note that such IPsec
implementations are not compliant with RFC 4301 [5]. For various
reasons, some implementations may choose to support only coarse-grain
selectors (i.e., addresses and in some cases the protocol field) for
forwarded traffic. As finer-grain selectors give better control,
i.e., the protection is only applied when required, the examples in
this document always use the finest granularity.
The following describes different ways of setting up IPsec policies
for protecting Mobile IPv6 messages:
1. The IPsec implementations on the mobile node and the home agent
support fine-grain selectors, including the Mobility Header
message type. This is the case assumed in the IPsec SPD and SAD
examples in this document.
2. The IPsec implementations only support selectors at a protocol
level. Such an IPsec implementation can only identify mobility
header traffic and cannot identify the individual mobility header
messages. In this case, the protection of Return Routability
Messages uses a setup similar to the regular payload packets sent
to the correspondent node with the protocol selector set to
Mobility Header. All tunneled Mobility Header messages will be
protected.
3. The third case is where the protocol selector is not available in
the IPsec implementation. In this case, all traffic sent by the
mobile node that is reverse tunneled through the home agent is
protected using ESP in tunnel mode. This case is also applicable
when the mobile node, due to privacy considerations, tunnels all
traffic to the home agent. This includes Mobile IPv6 signaling
messages exchanged between the mobile node and the home agent and
all traffic exchanged between the mobile node and the
correspondent node. This case uses IPsec tunnel mode SA with the
protocol selector set to 'any'.
The third case where all tunneled traffic is protected introduces
some additional considerations:
o If there is just one IPsec SA providing protection for all
traffic, then the SA MUST fulfill the requirements for protecting
the Return Routability messages which require confidentiality
protection. If the third case is being used for privacy
considerations, then there can also be separate tunnel mode SPD
entries for protecting the Return Routability messages with a
higher priority in the SPD so that the SPD entry with the higher
priority gets applied first.
o The receipt of a Binding Update from the new care-of address
updates the tunnel endpoint of the IPsec SA as described in
Section 4.3. Since the Binding Update that updates the tunnel
endpoint is received through the same tunnel interface that needs
to be updated, special care should be taken on the home agent to
ensure that the Binding Update is not dropped. This can be
achieved either by performing the source address check on the
outer IPv6 header after the binding update is processed or by
having exception handling to check the inner packet for a Binding
Update when the source address match on the outer source address
fails. Typical IPsec processing does not check the outer source
address when the originator of the packet has already been
authenticated.
6. Manual Configuration
This section describes the SPD and SAD entries that can be used to
protect Mobile IPv6 signaling messages. The SPD and SAD entries are
only example configurations. A particular mobile node implementation
and a home agent implementation could configure different SPD and SAD
entries as long as they provide the required security of the Mobile
IPv6 signaling messages.
For the examples described in this document, a mobile node with home
address, "home_address_1", primary care-of address,
"care_of_address_1", a home agent with address, "home_agent_1" and a
user of the mobile node with identity "user_1" are assumed. If the
home address of the mobile node changes, the SPD and SAD entries need
to be re-created or updated for the new home address.
The Peer Authorization Database is not used when manual IPsec
configuration is used for setting up security associations for
protecting Mobile IPv6 signaling messages.
6.1. Binding Updates and Acknowledgements
The following are the SPD and SAD entries on the mobile node and the
home agent to protect Binding Updates and Acknowledgements.
mobile node SPD-S:
- IF local_address = home_address_1 &
remote_address = home_agent_1 & proto = MH &
local_mh_type = BU & remote_mh_type = BAck
Then use SA SA1 (OUT) and SA2 (IN)
mobile node SAD:
- SA1(OUT, spi_a, home_agent_1, ESP, TRANSPORT):
local_address = home_address_1 &
remote_address = home_agent_1 &
proto = MH & mh_type = BU
- SA2(IN, spi_b, home_address_1, ESP, TRANSPORT):
local_address = home_agent_1 &
remote_address = home_address_1 &
proto = MH & mh_type = BAck
home agent SPD-S:
- IF local_address = home_agent_1 &
remote_address = home_address_1 & proto = MH &
local_mh_type = BAck & remote_mh_type = BU
Then use SA SA2 (OUT) and SA1 (IN)
home agent SAD:
- SA2(OUT, spi_b, home_address_1, ESP, TRANSPORT):
local_address = home_agent_1 &
remote_address = home_address_1 &
proto = MH & mh_type = BAck
- SA1(IN, spi_a, home_agent_1, ESP, TRANSPORT):
local_address = home_address_1 &
remote_address = home_agent_1 &
proto = MH & mh_type = BU
6.2. Return Routability Messages
The following are the SPD and SAD entries on the mobile node and the
home agent to protect Return Routability messages.
mobile node SPD-S:
- IF local_address = home_address_1 & remote_address = any &
proto = MH & local_mh_type = HoTi & remote_mh_type = HoT
Then use SA SA3 (OUT) and SA4 (IN)
mobile node SAD:
- SA3(OUT, spi_c, home_agent_1, ESP, TUNNEL):
local_address = home_address_1 & remote_address = any &
proto = MH & mh_type = HoTi
- SA4(IN, spi_d, care_of_address_1, ESP, TUNNEL):
local_address = any & remote_address = home_address_1 &
proto = MH & mh_type = HoT
home agent SPD-S:
- IF remote_address = home_address_1 & local_address = any &
proto = MH & local_mh_type = HoT & remote_mh_type = HoTi
Then use SA SA4 (OUT) and SA3 (IN)
home agent SAD:
- SA4(OUT, spi_d, care_of_address_1, ESP, TUNNEL):
local_address = any & remote_address = home_address_1 &
proto = MH & mh_type = HoT
- SA3(IN, spi_c, home_agent_1, ESP, TUNNEL):
local_address = home_address_1 & remote_address = any &
proto = MH & mh_type = HoTi
6.3. Mobile Prefix Discovery Messages
The following are the SPD and SAD entries used to protect Mobile
Prefix Discovery messages.
mobile node SPD-S:
- IF local_address = home_address_1 &
remote_address = home_agent_1 & proto = ICMPv6 &
local_icmp6_type = MPS & remote_icmp6_type = MPA
Then use SA SA5 (OUT) and SA6 (IN)
mobile node SAD:
- SA5(OUT, spi_e, home_agent_1, ESP, TRANSPORT):
local_address = home_address_1 &
remote_address = home_agent_1 &
proto = ICMPv6 & icmp6_type = MPS
- SA6(IN, spi_f, home_address_1, ESP, TRANSPORT):
local_address = home_agent_1 &
remote_address = home_address_1 &
proto = ICMPv6 & icmp6_type = MPA
home agent SPD-S:
- IF local_address = home_agent_1 &
remote_address = home_address_1 & proto = ICMPv6 &
local_icmp6_type = MPA & remote_icmp6_type = MPS
Then use SA SA6 (OUT) and SA5 (IN)
home agent SAD:
- SA6(OUT, spi_f, home_address_1, ESP, TRANSPORT):
local_address = home_agent_1 &
remote_address = home_address_1 &
proto = ICMPv6 & icmp6_type = MPA
- SA5(IN, spi_e, home_agent_1, ESP, TRANSPORT):
local_address = home_address_1 &
remote_address = home_agent_1 &
proto = ICMPv6 & icmp6_type = MPS
6.4. Payload Packets
Regular payload traffic between the mobile node and the correspondent
node tunneled through the home agent can be protected by IPsec, if
required. The mobile node and the home agent use ESP in tunnel mode
to protect the tunneled traffic. The SPD and SAD entries shown in
Section 5.2.4 of [3] are applicable here.
7. Dynamic Configuration
This section describes the use of IKEv2 to set up the required
security associations.
7.1. Peer Authorization Database Entries
The following describes PAD entries on the mobile node and the home
agent. The PAD entries are only example configurations. Note that
the PAD is a logical concept; a particular mobile node and a home
agent can implement the PAD in an implementation-specific manner.
The PAD state may also be distributed across various databases in a
specific implementation.
mobile node PAD:
- IF remote_identity = home_agent_identity_1
Then authenticate (shared secret/certificate/)
and authorize CHILD_SA for remote address home_agent_1
home agent PAD:
- IF remote_identity = user_1
Then authenticate (shared secret/certificate/EAP)
and authorize CHILD_SAs for remote address home_address_1
The list of authentication mechanisms in the above examples is not
exhaustive. There could be other credentials used for authentication
stored in the PAD.
In case of dynamic home address assignment, the home agent creates a
temporary PAD entry linking the authenticated peer identity and the
newly allocated home address.
7.2. Security Policy Database Entries
The following sections describe the security policy entries on the
mobile node and the home agent. The SPD entries are only example
configurations. A particular mobile node implementation and a Home
Agent implementation could configure different SPD entries as long as
they provide the required security of the Mobile IPv6 signaling
messages.
In the examples shown below, the identity of the user of the mobile
node is assumed to be user_1, the home address of the mobile node is
assumed to be home_address_1, the primary care-of address of the
mobile node is assumed to be care_of_address_1, and the IPv6 address
of the Home Agent is assumed to be home_agent_1.
7.2.1. Binding Updates and Acknowledgements
The following are the SPD entries on the mobile node and the home
agent for protecting Binding Updates and Acknowledgements.
mobile node SPD-S:
- IF local_address = home_address_1 &
remote_address = home_agent_1 &
proto = MH & local_mh_type = BU & remote_mh_type = BAck
Then use SA ESP transport mode
Initiate using IDi = user_1 to address home_agent_1
home agent SPD-S:
- IF local_address = home_agent_1 &
remote_address = home_address_1 &
proto = MH & local_mh_type = BAck & remote_mh_type = BU
Then use SA ESP transport mode
In the examples shown above, the home address of the mobile node
might not be available all the time. For instance, the mobile node
might not have configured a home address yet. When the mobile node
acquires a new home address, it must either add the address to the
corresponding SPD entries or create the SPD entries for the home
address.
The home agent should have named SPD entries per mobile node, based
on the identity of the mobile node. The identity of the mobile node
is stored in the "Name" selector in the SPD [5]. The home address
presented by the mobile node during the IKE negotiation is stored as
the remote IP address in the resultant IPsec security associations.
If the mobile node dynamically configures a home agent and the home
address, the home agent may not know which mobile nodes it is
supposed to be serving. Therefore, the home agent cannot have SPD
entries configured per mobile node. Instead, the home agent should
have generic SPD entries to prevent mobility header traffic that
requires IPsec protection from bypassing the IPsec filters. Once a
mobile node authenticates to the home agent and configures a home
address, appropriate SPD entries are created for the mobile node.
The Mobility Header message type is negotiated by placing it in the
most significant eight bits of the 16-bit local "port" selector
during IKEv2 exchange. For more details, refer to [5]. The TSi and
TSr payloads in the above examples will contain many other selectors
apart from home_address_1. For the sake of brevity, we show only
those values that are relevant for Mobile IPv6.
7.2.2. Return Routability Messages
The following are the SPD entries on the mobile node and the home
agent for protecting the Return Routability messages.
mobile node SPD-S:
- IF local_address = home_address_1 & remote_address = any &
proto = MH & local_mh_type = HoTi & remote_mh_type = HoT
Then use SA ESP tunnel mode
Initiate using IDi = user_1 to address home_agent_1
home agent SPD-S:
- IF local_address = any & remote_address = home_address_1 &
proto = MH & local_mh_type = HoT & remote_mh_type = HoTi
Then use SA ESP tunnel mode
When the mobile node's care-of address changes, the SPD entries on
both the mobile node and the home agent must be updated. The home
agent knows about the change in care-of address of the mobile node
when it receives a Binding Update from the mobile node.
7.2.3. Mobile Prefix Discovery Messages
The following are the SPD entries on the mobile node and the home
agent for protecting Mobile Prefix Discovery messages.
mobile node SPD-S:
- IF local_address = home_address_1 &
remote_address = home_agent_1 &
proto = ICMPv6 & local_icmp6_type = MPS &
remote_icmp6_type = MPA
Then use SA ESP transport mode
Initiate using IDi = user_1 to address home_agent_1
home agent SPD-S:
- IF local_address = home_agent_1 &
remote_address = home_address_1 &
proto = ICMPv6 & local_icmp6_type = MPA &
remote_icmp6_type = MPS
Then use SA ESP transport mode
In the examples shown above, the home address of the mobile node
might not be available all the time. When the mobile node acquires a
new home address, it must add the address to the corresponding SPD
entries.
The TSi and TSr payloads in the above examples will contain many
other selectors apart from home_address_1. For brevity, they are not
shown here.
7.2.4. Payload Packets
The following are the SPD entries on the mobile node and the home
agent if payload traffic exchanged between the mobile node and its
Correspondent Node needs to be protected. The SPD entries are
similar to the entries for protecting Return Routability messages and
have lower priority than the above SPD entries.
mobile node SPD-S:
- IF interface = IPv6 tunnel to home_agent_1 &
source = home_address_1 & destination = any & proto = X
Then use SA ESP tunnel mode
Initiate using IDi = user_1 to address home_agent_1
home agent SPD-S:
- IF interface = IPv6 tunnel to home_address_1 &
source = any & destination = home_address_1 & proto = X
Then use SA ESP tunnel mode
7.3. Security Association Negotiation Using IKEv2
Mobile IPv6 signaling messages are typically initiated by the mobile
node. The mobile node sends a Binding Update to the home agent
whenever it moves and acquires a new care-of address.
The mobile node initiates an IKEv2 protocol exchange if the required
security associations are not present. A possible mechanism used for
mutual authentication is a shared secret between the mobile node and
the home agent. The home agent uses the identity of the mobile node
to identify the corresponding shared secret. When a public-key-based
mechanism is available, it should be the preferred mechanism for
mutual authentication.
If a shared secret is being used, the mobile node uses the shared
secret to generate the AUTH payload in the IKE_AUTH exchange. If the
mobile node is using a public-key-based mechanism, then it uses its
private key to generate the AUTH payload in the IKE_AUTH exchange.
Mobile Node Home Agent
----------- ----------
HDR, SAi1, KEi, Ni -->
<-- HDR, SAr1, KEr, Nr, [CERTREQ]
HDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,]
AUTH, SAi2, TSi, TSr}
-->
<-- HDR, SK {IDr, [CERT,] AUTH,
SAr2, TSi, TSr}
The mobile node always includes its identity in the IDi payload in
the IKE_AUTH exchange. The mobile node could use the following
different types of identities to identify itself to the home agent.
o Home Address - The mobile node could use its statically configured
home address as its identity. In this case the ID Type field is
set to ID_IPV6_ADDR.
o FQDN - The mobile node can use a Fully Qualified Domain Name as
the identifier and set the ID Type field to ID_FQDN.
o RFC 822 identifier - If the mobile node uses a RFC 822 identifier
[9], it sets the ID Type field to ID_RFC822_ADDR.
The above list of identities is not exhaustive.
In the IKE_AUTH exchange, the mobile node includes the home address
and the appropriate selectors in the TSi (Traffic Selector-initiator)
payload to negotiate IPsec security associations for protecting the
Binding Update and Binding Acknowledgement messages. The mobile node
MAY use a range of selectors that includes the mobility message types
for Binding Update and Binding Acknowledgement to use the same pair
of IPsec security associations for both messages.
After the IKE_AUTH exchange completes, the mobile node initiates
CREATE_CHILD_SA exchanges to negotiate additional security
associations for protecting Return Routability signaling, Mobile
Prefix Discovery messages, and (optionally) payload traffic. The
CREATE_CHILD_SA exchanges are protected by IKEv2 security
associations created during the IKE_SA_INIT exchange. If a
correspondent node, that is also a mobile node, initiates the return
routability exchange, then the home agent initiates the
CREATE_CHILD_SA exchange to negotiate security associations for
protecting Return Routabilty messages.
It is important that the security associations are created based on
the home address of the mobile node, so that the security
associations survive care-of address change. The mobile node MUST
use its home address as the initiator IP address in the TSi payload
in the CREATE_CHILD_SA exchange in order to create the IPsec security
associations for the home address.
Mobile Node Home Agent
----------- ----------
HDR, SK {[N], SA, Ni, [KEi],
[TSi, TSr]} -->
<-- HDR, SK {SA, Nr, [KEr],
[TSi, TSr]}
When PKI-based authentication is used between the mobile node and the
Home Agent, the identity presented by the mobile node in the IDi
payload MUST correspond to the identity in the certificate obtained
by the Home Agent. The home agent uses the identity presented in the
IDi payload to lookup the policy and the certificate that corresponds
to the mobile node. If the mobile node presents its home address in
the IDi payload, then the home agent MUST verify that the home
address matches the address in an iPAddress field in the
SubjectAltName extension [8].
When the mobile node uses its home address in the IDi field,
implementations are not required to match the source address in the
outermost IP header with the IP address in the IDi field. According
to RFC 4306 [4], the IP header fields in the IKEv2 messages are
ignored and used only in the IP headers for IKEv2 messages sent as
replies.
7.4. Movements and Dynamic Keying
If the mobile node moves and its care-of address changes, the IKEv2
SA might not be valid. RFC 3775 defines a mechanism based on the
successful exchange of Binding Update and Binding Acknowledgement
messages. The mobile node establishes the IKE SA with the home agent
using its primary care-of address. The IKE SA endpoints are updated
on the home agent when it receives the Binding Update from the mobile
node's new care-of address and on the mobile node when it sends the
Binding Update to the home agent or when it receives the Binding
acknowledgement sent by the home agent. This capability to change
IKE endpoints is indicated through setting the Key Management
Capability (K) flag [2] in the Binding Update and Binding
Acknowledgement messages. If the mobile node or the home agent does
not support this capability, and has no other means to update the
addresses, then an IKEv2 exchange MUST be initiated to re-establish a
new IKE SA.
8. The Use of EAP Authentication
In addition to using public key signatures and shared secrets, EAP
[10] can be used with IKEv2 for authenticating the mobile node to the
home agent.
The mobile node indicates that it wants to use EAP by including the
IDi payload but leaving out the AUTH payload in the first message
during the IKE_AUTH exchange. The home agent then includes an EAP
payload if it is willing to use an extensible authentication method.
Security associations are not created until the subsequent IKE_AUTH
exchange after successful EAP authentication. The use of EAP adds at
least two round trips to the IKE negotiation. The number of round
trips depends on the EAP method used.
Mobile Node Home Agent
------------ ----------
HDR, SAi1, KEi, Ni -->
<-- HDR, SAr1, KEr, Nr, [CERTREQ]
HDR, SK {IDi, [CERTREQ,] [IDr,]
SAi2, TSi, TSr}-->
<-- HDR, SK {IDr, [CERT,] AUTH,
EAP }
.
.
.
HDR, SK {EAP} -->
<-- HDR, SK {EAP (success)}
HDR, SK {AUTH} -->
<-- HDR, SK {AUTH, SAr2, TSi,
TSr}
When EAP is used, the identity presented by the mobile node in the
IDi field may not be the actual identity of the mobile node. It
could be set to an identity that is used only for Authentication,
Authorization, and Accounting (AAA) routing purposes and selecting
the right EAP method. It is possible that the actual identity is
carried inside EAP, invisible to the home agent. While IKEv2 does
not allow an EAP Identity Request/Response message exchange, EAP
methods may exchange identities within themselves. In this case, the
home agent MUST acquire the mobile node's identity from the
corresponding AAA server. How the home agent acquires the mobile
node's identity is out of scope for this document.
Some EAP methods, when used with IKEv2, generate a shared key on the
mobile node and the Home Agent once the EAP authentication succeeds.
This shared key is used to generate the AUTH payloads in the
subsequent IKEv2 messages. The shared key, if used to generate the
AUTH payloads, MUST NOT be used for any other purpose. For more
details, refer to [4].
The use of EAP between the mobile node and the home agent might
require the home agent to contact an authorization server like the
AAA Home server, on the home link, to authenticate the mobile node.
Please refer to [7] for more details.
9. Dynamic Home Address Configuration
The mobile node can dynamically configure a home address by including
a Configuration Payload in the IKE_AUTH exchange, with a request for
an address from the home link. The mobile node should include a
zero-length INTERNAL_IP6_ADDRESS attribute in the CFG_REQUEST
Payload. The mobile node MAY include multiple instances of the
INTERNAL_IP6_ADDRESS to request multiple home address to the assigned
by the home agent.
When the home agent receives a configuration payload with a
CFG_REQUEST for INTERNAL_IP6_ADDRESS, it replies with a valid home
address for the mobile node. The INTERNAL_IP6_ADDRESS attribute in
the CFG_REPLY contains the prefix length of the home prefix in
addition to a 128 bit home address. The home agent could use a local
database or contact a DHCPv6 server on the home link to allocate a
home address. The duration for which the home address is allocated
to the mobile node is the same as the duration for which an IKEv2
security association exists between the mobile node and the home
agent. If the IKEv2 security association is rekeyed, the home
address lifetime is also extended.
Mobile Node Home Agent
----------- ----------
HDR, SK {IDi, [CERT,] [CERTREQ,]
[IDr,] AUTH, CP(CFG_REQUEST),
SAi2, TSi, TSr}
-->
<-- HDR, SK {IDr, [CERT,] AUTH,
CP(CFG_REPLY), SAr2,
TSi, TSr}
The mobile node could suggest a home address that it wants to use in
the CFG_REQUEST. For example, this could be a home address that was
allocated for the mobile node before or an address that the mobile
node auto-configured from the IPv6 prefix on the home link. The Home
Agent could let the mobile node use the same home address by setting
the INTERNAL_IP6_ADDRESS attribute in the CFG_REPLY payload to the
same home address. If the home agent wants the mobile node to use a
different home address, it sends a new home address in the
INTERNAL_IP6_ADDRESS attribute in the CFG_REPLY payload. The Mobile
Node MUST stop using its old home address and start using the newly
allocated home address.
In case the home agent is unable to allocate a home address for the
mobile node during the IKE_AUTH exchange, it MUST send a Notify
Payload with an INTERNAL_ADDRESS_FAILURE message. When the mobile
node receives a Notify Payload with an INTERNAL_ADDRESS_FAILURE
message, it SHOULD terminate the IKE_AUTH exchange. The mobile node
then should initiate a new IKE_SA_INIT and IKE_AUTH exchange and try
to auto-configure a home address as described in [13]. The mobile
node MAY also switch to another home agent. The new home agent
address can be obtained by consulting a home agent list received
during a previous home agent discovery phase or, if such list is
empty or not available, by attempting a new home agent discovery.
If the mobile node wants to configure a DNS server from the home
link, it can request the DNS server information by including an
INTERNAL_IP6_DNS attribute in the CFG_REQUEST payload.
10. Security Considerations
This document describes how IPsec can be used to secure Mobile IPv6
signaling messages. Please refer to RFC 3775 [2] for security
considerations related to the use of IPsec with Mobile IPv6.
A misbehaving mobile node could create IPsec security associations
for a home address that belongs to another mobile node. Therefore,
the home agent should check if a particular mobile node is authorized
to use a home address before creating IPsec security associations for
the home address. If the home address is assigned as described in
Section 9, the home agent MUST associate the home address with the
identity used in IKE negotiation. The home agent MAY store the
assigned home address in the SPD entries created for the mobile node.
The use of EAP for authenticating the mobile node to the home agent
is described in Section 8. Security considerations related to the
use of EAP with IKEv2 are described in [4].
11. Acknowledgements
The authors would like to thank Mika Joutsenvirta, Pasi Eronen, Jari
Arkko, Gerardo Giaretta, Shinta Sugimoto, Tero Kivinen, Steve
Bellovin, Kilian Weniger, and Vijay Gurbani for reviewing the
document.
Many of the requirements listed in Section 4 are copied from RFC
3776. Therefore, the authors of RFC 3776 are acknowledged.
12. References
12.1. Normative References
[1] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997.
[2] Johnson, D., Perkins, C., and J. Arkko, "Mobility Support in
IPv6", RFC 3775, June 2004.
[3] Arkko, J., Devarapalli, V., and F. Dupont, "Using IPsec to
Protect Mobile IPv6 Signaling Between Mobile Nodes and Home
Agents", RFC 3776, June 2004.
[4] Kaufman, C., "Internet Key Exchange (IKEv2) Protocol",
RFC 4306, December 2005.
[5] Kent, S. and K. Seo, "Security Architecture for the Internet
Protocol", RFC 4301, December 2005.
[6] Kent, S., "IP Encapsulating Security Payload (ESP)", RFC 4303,
December 2005.
12.2. Informative References
[7] Giaretta, G., "AAA Goals for Mobile IPv6", Work in Progress,
September 2006.
[8] Korver, B., "The Internet IP Security PKI Profile of IKEv1/
ISAKMP, IKEv2, and PKIX", Work in Progress, February 2007.
[9] Crocker, D., "Standard for the format of ARPA Internet text
messages", STD 11, RFC 822, August 1982.
[10] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
Levkowetz, "Extensible Authentication Protocol (EAP)",
RFC 3748, June 2004.
[11] Kent, S. and R. Atkinson, "Security Architecture for the
Internet Protocol", RFC 2401, November 1998.
[12] Sugimoto, S., "PF_KEY Extension as an Interface between Mobile
IPv6 and IPsec/IKE", Work in Progress, September 2006.
[13] Giaretta, G., "Mobile IPv6 bootstrapping in split scenario",
Work in Progress, December 2006.
Authors' Addresses
Vijay Devarapalli
Azaire Networks
3121 Jay Street
Santa Clara, CA 95054
USA
EMail: vijay.devarapalli@azairenet.com
Francis Dupont
CELAR
EMail: Francis.Dupont@fdupont.fr
Full Copyright Statement
Copyright (C) The IETF Trust (2007).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
ISO Plain Language
On this page
§1What Changed Since the Earlier Specification
RFC 3776 describes how IPsec, as described in RFC 2401, is used with Mobile IPv6 to protect the signalling messages, and it illustrates examples of Security Policy Database and Security Association Database entries for that purpose. This RFC updates it.
The IPsec architecture has been revised in RFC 4301. Among the many changes, the list of selectors has been expanded to include the Mobility Header message type. That changes how security policies and security associations are configured for protecting mobility header messages: it becomes easier to differentiate between the various Mobility Header messages from the type value, instead of checking whether a particular mobility header message is being sent on a tunnel interface between the mobile node and the home agent, as was the case in RFC 3776. The revised architecture also includes the ICMP message type and code as selectors, which makes it possible to protect Mobile Prefix Discovery messages without applying the same security associations to all ICMPv6 messages.
The Internet Key Exchange protocol has also been substantially revised and simplified. This RFC discusses the new requirements for the home agent and the mobile node to use the revised IPsec architecture and IKEv2. Section 4 lists the requirements, and sections 6 and 7 describe the required Security Policy Database and Security Association Database entries for manual and dynamic configuration. The use of EAP within IKEv2 is allowed to authenticate the mobile node to the home agent, and a method for dynamically configuring a home address using the Configuration Payload in IKEv2 is described as well.
Mobile IPv6 needs the signalling messages between a roaming device and its home router to be protected. The earlier specification did that with the older version of IPsec. This RFC updates it to the revised IPsec architecture and to IKEv2, the newer key exchange protocol, and it sets out exactly what each device must configure.
§3Packet Formats for Tunneled Signaling
The mobile node and the home agent MUST support the packet formats as defined in section 3 of RFC 3776.
In case the mobile node reverse tunnels all traffic, including the Mobile IPv6 signalling messages exchanged between the mobile node and the home agent, the Home Address Option is not required to be present in the messages sent to the home agent. The packet format for the binding update when sent in tunnel mode looks as follows.
IPv6 hdr (source = care-of address, destination = home agent)
ESP header in tunnel mode
IPv6 hdr (source = home address, destination = home agent)
Mobility Header
Binding Update
Alternate Care-of Address option (care-of address)The binding acknowledgement sent to the mobile node when it is away from the home link looks as follows.
IPv6 hdr (source = home agent, destination = care-of address)
ESP header in tunnel mode
IPv6 hdr (source = home agent, destination = home address)
Mobility Header
Binding AcknowledgementThe packet formats for tunneled mobile prefix discovery messages are very similar to the tunneled binding update and binding acknowledgement, with the home address as the source address in the inner IP header. Support for the tunneled packet format is optional on the mobile node and the home agent.
Two copies of an IPv6 header wrap the protected message. The outer header carries the roaming address, so the traffic can cross the Internet, and the inner header carries the home address, so the receiver sees the address it expects.
IPv6 hdr (source = care-of address, destination = home agent)
ESP header in tunnel mode
IPv6 hdr (source = home address, destination = home agent)
Mobility Header
Binding Update
Alternate Care-of Address option (care-of address)§4Requirements on the Mobile Node and Home Agent
Section 4 describes mandatory rules for all Mobile IPv6 mobile nodes and home agents, so that IPsec, with IKEv2 as the key management protocol, can protect traffic between the mobile node and the home agent. Many of the requirements are repeated from RFC 3776 to make the document self-contained.
The general requirements include that ESP encapsulation for Binding Updates and Binding Acknowledgements MUST be supported and used, and that ESP encapsulation in tunnel mode for the Home Test Init and Home Test messages tunneled between the mobile node and the home agent MUST be supported and SHOULD be used. ESP encapsulation of the ICMPv6 messages related to mobile prefix discovery MUST be supported and SHOULD be used, while ESP encapsulation of the payload packets tunneled between the two MAY be supported and used. If multicast group membership control protocols or stateful address autoconfiguration protocols are supported, payload data protection MUST be supported for those protocols.
The policy requirements say that, because the Mobility Header message type is now a selector, per-interface configuration of security policies is not required for protecting mobility header messages. The RFC notes the limit of that: without per-interface security policies, payload packet protection is limited to packets originating or terminating at the home address, and traffic using a link-local address within the Mobile IP tunnel cannot be given IPsec protection. The home agent MUST also be able to prevent a mobile node from using its security association to send a binding update on behalf of another mobile node, and it uses the Peer Authorization Database to store the per-mobile-node state that ties a mobile node's identity to its home address.
The IPsec processing requirements say that both devices SHOULD support the Mobility Header message type and the ICMPv6 message type as selectors, and that the home agent MUST be able to tell HoTi messages addressed to itself, when it is acting as a Correspondent Node, from those addressed to Correspondent Nodes, when it is acting as a home agent. When securing Binding Updates, Binding Acknowledgements and Mobile Prefix Discovery messages, both devices MUST support the ESP header in transport mode and MUST use a non-null payload authentication algorithm. The use of the ESP sequence number for anti-replay protection is optional, because the sequence numbers in the Binding Updates provide it, but that protection fails if the home agent loses its binding cache state, so complete anti-replay protection can only be provided by a dynamic keying mechanism such as IKEv2.
Because ESP leaves the care-of address in the outer IPv6 header unprotected, Mobile IPv6 implementations MUST use the Alternate Care-of Address option in Binding Updates sent while away from home, so that the home agent can verify that the address has not been tampered with. The dynamic keying requirements say that the mobile node MUST use its care-of address as source address in protocol exchanges when using dynamic keying, and that both devices MUST create security associations based on the home address, so that the associations survive changes in the care-of address.
The RFC lists what each side must do. Binding updates and acknowledgements are protected with ESP in transport mode, return routability messages with ESP in tunnel mode, and prefix discovery messages are protected too. The protection is keyed on the home address, so it keeps working when the device moves to a new network.
| Traffic | Protection |
|---|---|
| Binding Update and Binding Acknowledgement | ESP in transport mode |
| Home Test Init and Home Test | ESP in tunnel mode |
| Mobile Prefix Discovery messages | ESP in transport mode |
| Payload packets tunneled through the home agent | ESP in tunnel mode, optional |
§5How Precisely the Traffic Is Selected
IPsec implementations are compatible with this document even if they do not support fine-grain selectors such as the Mobility Header message type and the ICMPv6 message type, although such implementations are not compliant with RFC 4301. For various reasons some implementations support only coarse-grain selectors, that is, addresses and in some cases the protocol field, for forwarded traffic. Because finer-grain selectors give better control, since the protection is applied only when it is required, the examples in the document always use the finest granularity.
The RFC describes three ways of setting up IPsec policies for Mobile IPv6 messages. In the first, the implementations on the mobile node and the home agent support fine-grain selectors including the Mobility Header message type, which is the case assumed in the examples. In the second, the implementations support selectors at protocol level only, so they can identify mobility header traffic but not the individual messages; the protection of Return Routability messages then uses a setup similar to the regular payload packets sent to the correspondent node, with the protocol selector set to Mobility Header, and all tunneled Mobility Header messages are protected. In the third, the protocol selector is not available at all, so all traffic sent by the mobile node that is reverse tunneled through the home agent is protected using ESP in tunnel mode, with the protocol selector set to any. That third case also applies when the mobile node tunnels all traffic to the home agent for privacy reasons.
The third case brings two extra considerations. If there is just one security association providing protection for all traffic, it MUST fulfil the requirements for protecting the Return Routability messages, which require confidentiality protection. Where the third case is used for privacy reasons, separate tunnel mode policy entries can protect the Return Routability messages with a higher priority, so that the entry with the higher priority is applied first. The second consideration is that the Binding Update which updates the tunnel endpoint arrives through the same tunnel that has to be updated, so the home agent has to be careful not to drop it, either by checking the source address on the outer IPv6 header after the binding update is processed or by exception handling that checks the inner packet when the outer source address does not match.
How well the protection can be aimed depends on the IPsec implementation. A device that understands the mobility message types can protect only the messages that need it. A simpler device protects everything in the tunnel instead, which is safer but uses more of the link's capacity.
- Fine-grain selectorsThe implementation understands the mobility message type, so only the messages that need protection are protected.
- Protocol-level selectorsThe implementation sees only mobility header traffic, so all tunneled mobility header messages are protected together.
- No protocol selectorEverything the mobile node tunnels through the home agent is protected with ESP in tunnel mode.
§7.3Negotiating Security Associations with IKEv2
Mobile IPv6 signalling messages are typically initiated by the mobile node, which sends a Binding Update to the home agent whenever it moves and acquires a new care-of address. The mobile node initiates an IKEv2 exchange if the required security associations are not present.
A possible mechanism for mutual authentication is a shared secret between the mobile node and the home agent, and the home agent uses the identity of the mobile node to identify the corresponding shared secret. When a public-key-based mechanism is available, it should be the preferred mechanism. If a shared secret is used, the mobile node uses it to generate the AUTH payload in the IKE_AUTH exchange; if it uses a public-key-based mechanism, it uses its private key.
The exchange has four messages. The mobile node sends the first with its proposed security association, its key exchange payload and a nonce. The home agent replies with its own proposal, its key exchange payload, a nonce and, optionally, a certificate request. The mobile node then sends an encrypted message carrying its identity, optionally a certificate and a certificate request, the home agent's identity if it was learned, the AUTH payload, its second security association proposal and the traffic selectors. The home agent answers with an encrypted message carrying its identity, optionally a certificate, its AUTH payload, its second security association proposal and the traffic selectors.
The mobile node always includes its identity in the IDi payload in the IKE_AUTH exchange. It can identify itself with its statically configured home address, in which case the ID Type field is set to ID_IPV6_ADDR, with a Fully Qualified Domain Name, with the ID Type field set to ID_FQDN, or with an RFC 822 identifier, with the ID Type field set to ID_RFC822_ADDR. The list of identities is not exhaustive.
In the IKE_AUTH exchange the mobile node includes the home address and the appropriate selectors in the TSi payload, to negotiate the security associations that protect the Binding Update and Binding Acknowledgement messages. After IKE_AUTH completes, the mobile node initiates CREATE_CHILD_SA exchanges to negotiate the additional associations for Return Routability signalling, Mobile Prefix Discovery messages and, optionally, payload traffic. Those exchanges are protected by the IKEv2 security associations created during the IKE_SA_INIT exchange.
It is important that the security associations are created based on the home address, so that they survive a change of care-of address, and the mobile node MUST use its home address as the initiator IP address in the TSi payload of the CREATE_CHILD_SA exchange. When public-key authentication is used, the identity in the IDi payload MUST correspond to the identity in the certificate the home agent obtains, and if the mobile node presents its home address the home agent MUST verify that the home address matches an iPAddress field in the SubjectAltName extension.
When the device needs new protected channels, it negotiates them with the home router using IKEv2. Both sides prove who they are with a shared secret or a certificate, and the mobile device asks for protection of the specific message types it needs.
- IKE_SA_INITHDR, SAi1, KEi, Ni
- IKE_SA_INIT REPLYHDR, SAr1, KEr, Nr, [CERTREQ]
- IKE_AUTHHDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,] AUTH, SAi2, TSi, TSr}
- IKE_AUTH REPLYHDR, SK {IDr, [CERT,] AUTH, SAr2, TSi, TSr}
§8Using EAP to Authenticate the Mobile Node
In addition to using public key signatures and shared secrets, EAP can be used with IKEv2 for authenticating the mobile node to the home agent.
The mobile node indicates that it wants to use EAP by including the IDi payload but leaving out the AUTH payload in the first message during the IKE_AUTH exchange. The home agent then includes an EAP payload if it is willing to use an extensible authentication method. Security associations are not created until the subsequent IKE_AUTH exchange, after successful EAP authentication. The RFC notes that the use of EAP adds at least two round trips to the IKE negotiation, and that the number of round trips depends on the EAP method used.
When EAP is used, the identity the mobile node presents in the IDi field may not be its actual identity. It could be set to an identity used only for Authentication, Authorization and Accounting routing purposes and for selecting the right EAP method, and the actual identity may be carried inside EAP, invisible to the home agent. IKEv2 does not allow an EAP Identity Request or Response message exchange, but EAP methods may exchange identities within themselves. In that case the home agent MUST acquire the mobile node's identity from the corresponding AAA server, and how it does so is out of scope for this document.
Some EAP methods generate a shared key on the mobile node and the home agent once the EAP authentication succeeds. That shared key is used to generate the AUTH payloads in the subsequent IKEv2 messages, and it MUST NOT be used for any other purpose. The use of EAP between the mobile node and the home agent might also require the home agent to contact an authorization server such as the AAA Home server on the home link.
EAP lets the home router ask another system, such as a corporate login server, to check the user's credentials. It costs at least two extra round trips, and the real identity of the user may stay hidden inside the EAP exchange.
- IKE_SA_INITHDR, SAi1, KEi, Ni
- IKE_SA_INIT REPLYHDR, SAr1, KEr, Nr, [CERTREQ]
- IKE_AUTH WITHOUT AUTHHDR, SK {IDi, [CERTREQ,] [IDr,] SAi2, TSi, TSr}
- EAP REQUESTHDR, SK {IDr, [CERT,] AUTH, EAP }
- EAP RESPONSEHDR, SK {EAP}
- EAP SUCCESSHDR, SK {EAP (success)}
- IKE_AUTH WITH AUTHHDR, SK {AUTH}
- IKE_AUTH REPLYHDR, SK {AUTH, SAr2, TSi, TSr}
§9Getting a Home Address over IKEv2
The mobile node can dynamically configure a home address by including a Configuration Payload in the IKE_AUTH exchange, with a request for an address from the home link. It should include a zero-length INTERNAL_IP6_ADDRESS attribute in the CFG_REQUEST payload, and it MAY include multiple instances of that attribute to request several home addresses.
When the home agent receives a configuration payload with a CFG_REQUEST for INTERNAL_IP6_ADDRESS, it replies with a valid home address for the mobile node. The INTERNAL_IP6_ADDRESS attribute in the CFG_REPLY contains the prefix length of the home prefix in addition to a 128 bit home address. The home agent could use a local database or contact a DHCPv6 server on the home link. The duration for which the home address is allocated is the same as the duration for which an IKEv2 security association exists between the mobile node and the home agent, and if that association is rekeyed, the home address lifetime is extended as well.
The mobile node could suggest a home address that it wants to use in the CFG_REQUEST, for example one allocated for it before or one it auto-configured from the IPv6 prefix on the home link. The home agent can let the mobile node keep the same address by setting the INTERNAL_IP6_ADDRESS attribute in the CFG_REPLY to that address, or send a new address if it wants a different one, in which case the mobile node MUST stop using its old home address and start using the newly allocated one.
If the home agent is unable to allocate a home address during the IKE_AUTH exchange, it MUST send a Notify payload with an INTERNAL_ADDRESS_FAILURE message, and the mobile node then SHOULD terminate the IKE_AUTH exchange, start a new IKE_SA_INIT and IKE_AUTH exchange and try to auto-configure a home address. It MAY also switch to another home agent, whose address can come from a home agent list received during an earlier discovery phase or, if that list is empty or not available, from a new discovery attempt. If the mobile node wants to configure a DNS server from the home link, it can request the DNS server information by including an INTERNAL_IP6_DNS attribute in the CFG_REQUEST payload.
The device can ask for its home address over the same secure channel it uses for everything else. The home router picks an address from its own records or from a DHCPv6 server, and the address is valid for as long as the secure channel lasts.
§10Security Considerations
The RFC refers to RFC 3775 for the security considerations that apply to the use of IPsec with Mobile IPv6, and to RFC 4306 for those that apply to the use of EAP with IKEv2.
It adds one point of its own. A misbehaving mobile node could create IPsec security associations for a home address that belongs to another mobile node. The home agent should therefore check that a particular mobile node is authorized to use a home address before creating security associations for that home address. If the home address was assigned as described in section 9, the home agent MUST associate the home address with the identity used in the IKE negotiation, and it MAY store the assigned home address in the security policy entries created for the mobile node.
The main risk is one mobile device pretending to be another so that it can claim its home address. The home router therefore checks that the identity it authenticated is allowed to use the address before it sets up protection for it.