0,3YDQGLWVVHFXULW\ FKDOOHQJHV 0$,1²0RELOLW\IRU$OO,31HWZRUNV²0RELOH,3 (XUHVFRP:RUNVKRS %HUOLQ$SULO

Transcription

1 0,3YDQGLWVVHFXULW\ FKDOOHQJHV 0$,1²0RELOLW\IRU$OO,31HWZRUNV²0RELOH,3 (XUHVFRP:RUNVKRS %HUOLQ$SULO COMBES Jean-Michel CHARLES Olivier Le présent document contient des informations qui sont la propriété de France Télécom. L'acceptation de ce document par son destinataire implique, de la part de ce dernier, la reconnaissance du caractère confidentiel de son contenu et l'engagement de n'en faire aucune reproduction, aucune transmission à des tiers, aucune divulgation et aucune utilisation commerciale sans l'accord préalable écrit de (Nom du fichier) - D1-01/03/2000

2 ,QWURGXFWLRQ Need for IP security in telephony networks Mobile Internet convergence in cellular networks Mobile IP based UMTS core network l Seamless IP data network l Handoff at IP level Telcos have to add IP security to their traditional security policies Does the usual Internet security tools meet the telcos requirements? Protecting the network against intrusions and attacks Protecting their customers against hackers Granting integrity of accounting data La communication de ce document est soumise à autorisation de (Nom du fichier) - D2-01/03/2000

3 2YHUYLHZ Mobile IPv6 : built-in secure mechanisms Mobility : an new point of view for the security MobiSecV6 : from theory to reality And now La communication de ce document est soumise à autorisation de (Nom du fichier) - D3-01/03/2000

4 0RELOH,3YEXLOWLQVHFXUH PHFKDQLVPV Binding Update Use of AH/transport to authenticate l Mobile Node s Home Address l Mobile Node s Care-of Address Binding Acknowledgment Use of AH/transport to authenticate l Correspondent s Address l Mobile Node s Home Address l Mobile Node s Care-of Address Renumbering the Home Subnet Use of IPsec to authenticate l Router advertisement La communication de ce document est soumise à autorisation de (Nom du fichier) - D4-01/03/2000

5 0RELOH,3YEXLOWLQVHFXUH PHFKDQLVPV Use of IPsec/IKE Use of Mobile Node s Home Address l SPD l IKE phase two l SAD Use of Mobile Node s Care-of Address l IKE phase one La communication de ce document est soumise à autorisation de (Nom du fichier) - D5-01/03/2000

6 0RELOLW\DQQHZSRLQWRIYLHZ IRUWKHVHFXULW\ Home network protection Securing mobility signalization l IPsec between Home Agent and Mobile Node Allowing the Mobile Node Node to have the same access to home network s services l Mobile IPv6 Firewall Mobile Node protection Protecting the Mobile Node as it was at home (do not trust visited FW) l Personal Firewall Foreign network security Checking communications on the network (acces control on visited networks) l AAAv6 (plus DHCPv6) La communication de ce document est soumise à autorisation de (Nom du fichier) - D6-01/03/2000

7 0REL6HF9IURPWKHRU\WR UHDOLW\ RNRT project : French government project Dates : September 1998 February 2001 Partners : Bull INRIA France Telecom R&D Subject : Study and implementation of MIPv6 Study and implementation of IPsec/IKEv6 Study and implementation of HMIPv6 Study and implementation of a Mobile IPv6 Firewall Integration in a testbed La communication de ce document est soumise à autorisation de (Nom du fichier) - D7-01/03/2000

8 0REL6HF9IURPWKHRU\WR UHDOLW\ Results Implementations l MIPv6/IPsec/IKEv6 on AIX (Bull) l MIPv6/IPsec/IKEv6 on FreeBSD (INRIA) l HMIPv6/IPsec/IKEv6 on FreeBSD (INRIA) l MIPv6 Firewall on AIX (Bull) Testbed l In two parts : Paris and Rennes l Media : Ethernet, l Services : DNS, WWW, FTP, Game (Tetris) l ALL SECURED!!! La communication de ce document est soumise à autorisation de (Nom du fichier) - D8-01/03/2000

9 0REL6HF9IURPWKHRU\WR UHDOLW\ Implication on MIPv6 standardization l Use of AH to protect used informations data (ie. H@, Co@, BU) l Use of IKE what kind of address used in negotiation phases l Home Address Destination Option place before AH/ESP Header to be used by Mobile IPv6 Firewall La communication de ce document est soumise à autorisation de (Nom du fichier) - D9-01/03/2000

10 $QGQRZ«Mobile IPv6 security : need for new security features why? l Maintaining IPsec SA l Setting up IPsec SA (IKE) l IPsec granularity l AH complexity l PKI/DNSEC/AAA IETF should provide a set of requirements for the new solution l not yet and solutions l BAKE l SUCV l La communication de ce document est soumise à autorisation de (Nom du fichier) - D10-01/03/2000

11 $QGQRZ«Network Access AAAv6 DHCPv6 Mobile Node Protection Personal Firewall La communication de ce document est soumise à autorisation de (Nom du fichier) - D11-01/03/2000