1 / 37

New Technologies for Integrated Public Wireless Networks

New Technologies for Integrated Public Wireless Networks. Milind M. Buddhikot http://www.bell-labs.com/user/mbuddhikot/ mbuddhikot@bell-labs.com Center for Networking Research Lucent Bell Labs Research joint work with Scott Miller, Girish Chandranmenon, Clement Lee,

jackson-webb
Download Presentation

New Technologies for Integrated Public Wireless Networks

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. New Technologies for Integrated Public Wireless Networks Milind M. Buddhikot http://www.bell-labs.com/user/mbuddhikot/ mbuddhikot@bell-labs.com Center for Networking Research Lucent Bell Labs Research joint work with Scott Miller, Girish Chandranmenon, Clement Lee, SJ Han, Luca Salgarelli (Bell Labs) Stelios Sidiroglou-Douskas, Kundan Singh (Columbia)

  2. Outline • Integrated Public Wireless Networks • Current Trends and Rationale for Integration • Architectural approaches • Tight • Loose • IOTA: Implementation for 802.11/CDMA2000 integration • IOTA Gateway • Multi-interface client • MobileIOTA: Portable and transient hotspots • SKE:Authentication and Key Exchange in Integrated Networks • IOTAClusters: Managed ad-hoc infrastructure • Conclusions Milind Buddhikot (Opensig03)

  3. Wireless Access Networks 2.5G/3G Access of C WiFi Access of A WiFi Access of B One bill from One provider (3G carrier?) Roaming or even Seamless Handoff in Multiple Networks Uninterrupted Applications: Streaming, Email, Corporate VPN, Web Subscriber Service 3G card WiFi card Terminal Possibilities Laptop with Built-in WiFi & 3G Laptop Laptop with Built-in WiFi PDA w/ WiFi & 3G 3G card Evolving Picture • Customers with multi-radio capable end devices • 3G1X, 3G1XEVDO, UMTS, 802.11a/b access operated by different providers • Multitudes of applications, seamless roaming, preserve sessions, single bill Milind Buddhikot (Opensig03)

  4. Wireless Access Networks 2.5G/3G Access of C WiFi Access of A WiFi Access of B Handoff Possibilities Intertech Internetwk Handoff Intratech Internetwk Handoff One bill from One provider (3G carrier?) Roaming or even Seamless Handoff in Multiple Networks Uninterrupted Applications: Streaming, Email, Corporate VPN, Web Subscriber Service 3G card WiFi card Terminal Possibilities Laptop with Built-in WiFi & 3G Laptop Laptop with Built-in WiFi PDA w/ WiFi & 3G 3G card Evolving Picture • Seamless roaming: • Efficient authentication • inter and intra-tech handoffs viaInteroperation of mobility mechanisms • Billing info across access networks and providers • Uniform service mapping • Roaming Agreements! Milind Buddhikot (Opensig03)

  5. Roaming agreement Roaming agreement Wireless ISP A Wireless ISP B Corporate Network D Cellular Carrier C VPN Network Owners Internet Wireless Access Networks 2.5G/3G Access of C WiFi Access of A WiFi Access of B Handoff Possibilities Intertech Internetwk Handoff Intratech Internetwk Handoff One bill from One provider (3G carrier?) Roaming or even Seamless Handoff in Multiple Networks Uninterrupted Applications: Streaming, Email, Corporate VPN, Web Subscriber Service 3G card WiFi card Terminal Possibilities Laptop with Built-in WiFi & 3G Laptop Laptop with Built-in WiFi PDA w/ WiFi & 3G 3G card Complete Picture Milind Buddhikot (Opensig03)

  6. Integration Architectures - Tight and Loose

  7. Infrastructure mode: MNs communicate via base stations Access Points (AP) AP s together with Ethernet characterized by ESSID 11-54 Mbps, Range limited 300-500m MN-AP communication encrypted using WEP WEP with MICHAEL in WPA1 AES in WPA-2 Encryption keys may be established Statically Dynamically using 802.1x With TKIP in WPA Layer-2 mobility via inter-AP protocols Router 802.11b Network To Internet MN: Mobile Node STA: Station AP: Access Point Encrypted AP AP MN MN MN STA MN MN Milind Buddhikot (Opensig03)

  8. 144 Kbps per carrier MN maintains RLP connection to RNC PPP connection to PDSN PDSN supports Mobile-IP and Simple-IP mode FA functions in MIP mode Radio Access Network H-AAA F-AAA Base Station Web server HA SS7 Network PCF RNC PDSN Internet HLR Base Station MSC/ VLR Radio Link Protocol Point-to-Point Protocol Representative 3G Network: CDMA2000 1X-RTT HLR : Home Location Register VLR : Visited Location Register F-AAA : Foreign AAA H-AAA : Home AAA HA : Home Agent FA : Foreign Agent PDSN : Packet Data Serving Node PCF : Packet Control Function RNC : Radio Network Control Milind Buddhikot (Opensig03)

  9. Billing Servers Home AAA Internet GGSN/ PDSN Local AAA 3G Core Network WISP 1: Tight integration SGSN Or PCF 3G Wireless Access RNC 802.11 Gateway BS 802.11 Access BS 802.11 Access Points Tight Integration • 802.11 gateway uplink connects to the to 3G core network • Connect to GGSN in UMTS or PDSN in 3GPP2 • Uplink is ATM over T1, T3, or SONET • Ethernet, POS with IP Release 6 of UMTS. • Gateway appears as a new SGSN or PCF “Home” network (3G carrier) MN Milind Buddhikot (Opensig03)

  10. Tight Integration (contd.) • Goal: Use the 3G protocol stack on the MN to sign on and use 802.11 networks • 802.11 RADIO is yet another 3G radio • Advantages: • Requires minimal changes to the client (in theory) • Use same authentication infrastructure and profile • Easy to generate one common billing statement • Easy to view 802.11 network from the network management point  Disadvantages far outweigh the above Milind Buddhikot (Opensig03)

  11. Disadvantages of Tight Integration • Traffic engineering: • 802.11 traffic over the 3G core network increases traffic load on well-engineered 3G core by ~25 to 100 times • Core network must be re-engineered else QoS for regular 3G traffic severely affected • Client software • Include 3G stack even for 802.11 only users • New 802.1x signaling to transport 3G specific signaling traffic • Involves client changes , definition of new EAP types. 3G software not usable transparently • Authentication overhead • Use of 3G authentication scheme requires gateway interface to a VLR and/or implement VLR functions • Ciphering, Integrity keys in 3G may not be usable in a 802.11 encryption procedure Milind Buddhikot (Opensig03)

  12. Provider Nightmare • 802.11 infrastructure must be owned by 3G provider • 3G provider burdened with rollout of 3G and 802.11! • Else, if 802.11 network operated by other provider • Alternate internet uplink for non-3G roaming customers • If 802.11 provider wants roaming agreement with multiple 3G providers it must have at least one uplink or tunnel per provider! • Provider cores are non-overlapping • Wireless carrier cannot benefit from 802.11 Wireless ISP deployments • 802.11 networks not deployed independently of 3G • Gateway complicated for co-existing non-3G and 3G-roaming customers • QoS mapping from UMTS to 802.11e for roaming 3G customers • SS7 awareness for authentication Milind Buddhikot (Opensig03)

  13. Billing Servers Internet Home AAA PDSN or GGSN Local AAA WISP 1: Loose integration 3G Core Network PCForSGSN 3G Wireless Access RNC 802.11 Gateway BS 802.11 Access BS 802.11 Access Points Loose Integration Architecture • 802.11 gateway connected to the internet via uplink • Layer-2 or layer-3 connection • No direct connectivity to 3G core network • Loose:Data paths for two networks completely separated • 802.11 network can be owned by different provider • Roaming contract with 3G provider “Home” network (3G carrier) Milind Buddhikot (Opensig03)

  14. Loose Integration • 802.11 provider authenticates the 3G roaming customer using 3G credentials • Roaming agreement with 3G provider which allows authentication traffic to be directed to 3G AAA/HLR • 3G provider may have to support new authentntication schemes as a part of roaming agreement • E.g.: SKE, AKA, SIM • 802.11/802.1x keys can be derived as an outcome of authentication protocol • Billing records generated by the gateway shipped to 3G HLR/H-AAA • Revenue settlement at a later date Milind Buddhikot (Opensig03)

  15. IOTA: A Prototype Implementation

  16. The IOTA prototype • IOTA=Integration Of Two Access technologies • 802.11b and 1XRTT, 1XEV-DO networks • Research prototype that implements the loosely-coupled architecture • Highly modularized IOTA gateway • Runs on off-shelf hardware (single/dual processor 750 MHz, Linux OS) • Multi-interface mobility client software, • Management of mobility across multiple network interfaces and multiple wireless/wireline technologies Milind Buddhikot (Opensig03)

  17. IP components Active Session State Database IP Forwarding Packet-Mangle QoS Firewall NAT IOTA PktFilter DHCP Server QoS Module Uplink Interface Web Services Web Cache Web Server Local Portal Mobility management IPC Service MIP Foreign Agent MIP Home Agent Downlink Interface Authentication and Accounting Accounting Daemon RADIUS Server/Proxy Kernel space Datapath User space Architecture of the IOTA gateway Milind Buddhikot (Opensig03)

  18. Home AAA Home Agent Internet Edge Router IP QoS on access bottleneck Access Router 802.11 QoS over air IOTA Gateway 10 Mbps 10 Mbps 10 Mbps Gold Service User Silver Service User Bronze Service User QoS Features for 802.11 • QoS in two spots of congestion • IP QoS on oversubscribed access • QoS on 802.11 air interface (layer-2) • Layer-7/4/3 mechanisms for IP level QoS that complements 802.11e • Class based QoS • Gold, Silver, Bronze with minimum rate guarantee • No special client software needed. • Per user service level policy obtained from H-AAA in AAA exchange • Map user population in 802.11 cells to achieve fairness and QoS guarantees • SNMP queries to 802.11 APs • DiffServ packet marking and traffic policing • Gateway can mark packets even with Mobile IP tunnels Milind Buddhikot (Opensig03)

  19. IP components IPF DHCP Server QoS Module Web Services Web Cache Web Server Local Portal Mobility management MIP Foreign Agent MIP Home Agent Authentication and Accounting Accounting Daemon RADIUS Server/Proxy Software architecture of the IOTA gateway Active Session State Database IP Forwarding Packet-Mangle QoS Firewall NAT Uplink Interface The Web Cache is a proprietary, high-performance caching web-proxy. It is especially useful with the Mobile-IP service. IPC Service Downlink Interface User space Kernel space Milind Buddhikot (Opensig03)

  20. Web Cache Home AAA Home AAA Web Site Web Site Home Agent Web response Web request 2 5 3 4 2 1 3 1 4 Layer-4 switch Benefits of Integrated Web Cache • Reduces congestion on access lines to 802.11 network • Provides performance optimization for web traffic by not routing packets back to Mobile IP home agent from cache; can only be done if cache is integrated with foreign agent in same box Home Agent Internet Internet Edge Router Edge Router Access Router w/ Foreign Agent Access Router Integrated small-scale web cache 802.11 Gateway 10 Mbps Milind Buddhikot (Opensig03)

  21. IOTA Multi-interface Mobility Client

  22. IOTA Client - Features • Supports mobility across several kinds of physical interfaces • List of physical interfaces configured with associated priorities • Seamless : A user process doesn’t see any change in its connections. • Selection of the interface to use dependent on the user preference, signal strength, availability of a mobility agent in the network. • Bounce protection algorithm that uses hysteresis to minimize the switching • between the interfaces, • between access points on the same interface • Allow IPSec tunneling independent of mobility. Milind Buddhikot (Opensig03)

  23. Client GUI Multi-interface Mobility Client Driver API IOTA client architecture IPSec Client User space Kernel space TCP/IP Stack IPSec Client Driver Multi-interface mobility driver Ethernet driver 802.11 driver PPP driver 3G-1x driver Milind Buddhikot (Opensig03)

  24. New code developed, Specifically for 3G-802.11 integration VPN/IPSec integration (e.g. Lucent IPSec Client) Interaction with Existing Windows OS modules IOTA Client Architecture Graphical User Interface & Monitoring • Software runs on Windows 2000/XP operating system • Approximately 45,000 lines of code, 13,000 of which are Windows NDIS kernel networking code VPN/ IPSec Control User Level Mobile NATClient Network Selection Mobile IP State Machine Network Detection Interface Abstraction Layer/API OS PPP Support Ethernet 802.11 PPP CDMA2000 Sierra 3G1xRTT TCP/IP Protocol Stack VPN/IPSec Client Driver Serial Driver AT Command Set Multi-interface Mobility Client Driver OS Kernel Level IS-835 Shim Virtual MobileIP Adaptor 802.11 Interface Ethernet Interface PPP Interface Milind Buddhikot (Opensig03)

  25. Client GUI A simple and effective GUI that reports the most current status of the networks and the mobility manager. It also allows users to edit the configuration information. Milind Buddhikot (Opensig03)

  26. Shared Key Exchange (SKE)

  27. Integrating 802.11 and 3G: Service Provider Wish List • Subscriber Ownership • Offer 802.11 hot spot access to a 3G wireless subscriber as a value added service • Potentially better performance and QoS • Volume subscribers (by millions) for 802.11 operators • Transparent handoff and roaming • Allow customers with dual radio modem to transparently handoff from a 3G wireless infrastructure to a 802.11 network • Roaming agreement between 3G operator and 802.11 operator • Use one common AAA and billing infrastructure for integrated access • Avoid creating duplicate and disparate authentication mechanisms • Use of one common shared secret • How to achieve this ? Our SKE protocol is a part of the solution Milind Buddhikot (Opensig03)

  28. kMN-SMS kMN-FA kMN-HA Basic Authentication Model • KMN-H-AAA : Security association between MN and H-AAA • Pre-established at service initiation or derived from a <UserID, PassWd> • KMN-SMS: 802.11 Layer-2 encryption key • Per session, per MN dynamic key for encryption • KMN-FA , KMN-HA: Layer-3 Mobile IP (MIP) registration keys • Per MIP session KMN-H-AAA AP F-AAA H-AAA MN FA HA Milind Buddhikot (Opensig03)

  29. SKE Design Requirements • Fraud protection: • Prevent unauthorized users from receiving service from visited networks without paying for it • Prevent session hijacking (RFC2828): • Prevent users from seizing control of a ongoing communication association previously established by another user • Authenticate MN: • Allow H-AAA to authenticate and authorize that the MN has rights receive service from a foreign domain with which the home domain has a roaming agreement. • Allow MN to authenticate H-AAA: • Allow the MN to establish that it is authenticating to a trusted H-AAA that is in possession of KMN, H-AAA Milind Buddhikot (Opensig03)

  30. SKE Design Requirements • Session Key Establishment: • Establish per session dynamic shared secret key KMN, AP . Guarantee both MN supplicant and H-AAA that this key is fresh, random and unique. • Guarantee Forward Secrecy: • compromise of a session key permits access to data protected by that key • Path Authentication by MN and H-AAA • Allow MN and H-AAA to verify the path between MN and H-AAA • Efficiency: • Minimal message exchange Milind Buddhikot (Opensig03)

  31. EAP-Resp (SKE-Success) EAP –Req (Auth2,N_3 ) EAP (Success) EAP-Req (Identity Req) RADIUS/EAP-Req(N1) EAP-Resp (Auth1, N_2) RADIUS/EAP-Resp RADIUS/EAP-Resp(NAI,SID) EAP-Req (Challenge N_1) EAP-Resp(NAI,SID) EAPOL-START RADIUS/EAP-Success RADIUS/EAP-Resp RADIUS/EAP-Req RadiusAccessReq N1, N2, AUTH1, UID, SID ASID 15 12 11 4 0 2 6 7 5 3 10 14 13 1 8 8 - Authenticate Auth1 Compute kMN-SMS Compute Auth1 using kMN-H3A Attr: NAI, SID, AUTH1, [ASID] Radius Resp 9 Verify Auth2 Compute kMN,SMS Attr: AUTH2,N_3, KSMS Attr: AUTH2, N_3, KSMS Complete EKP-SKE Message Flow KMN-H-AAA AP F-AAA H-AAA MN kMN-AP Milind Buddhikot (Opensig03)

  32. SKE Computations • Message 4: • (a) MN generates its own challenge N2 • (b) MN computes a MAC code Auth1 -- Auth1 = MAC (KMN-HAA, N1 | N2 | NAI|SID|ASID) Sends the (Auth1, N2) to APF-AAA Milind Buddhikot (Opensig03)

  33. What is the computation in Step 7? • Compute AUTH1’=MAC (KMN-HAA, N1 | N2 | NAI|SID|ASID) • Is AUTH1’ == AUTH1? • If yes, H-AAA concludes MN is authenticated and does following • Generates N3 • (a) a random number, (b) a monotonically increasing integer or (c) a pre-configured constant. • Compute Authenticator for MN to validate H-AAA • AUTH2 = MAC(KMN-H-AAA, N2 | N1 | NAI|SID|ASID) • Note change in the order of arguments with respect to AUTH1. • Compute dynamic session key • KMN-SMS= PRF(KMN-H-AAA, N3 | AUTH2) • When N3 new for every request, it guarantees key freshness Milind Buddhikot (Opensig03)

  34. Discussion • KMN-H-AAA can be segmented into hierarchy of multiple keys much like EAP-ARCHIE • One of the keys used to cipher the challenge N1, N2 and AUTH responses Milind Buddhikot (Opensig03)

  35. Scheme Architecture Networking Requirements RTT to F-AAA/H-AA Statelessness EAP-SKE Shared key with H-AAA 1 Yes EAP-SIM Subscribe Identity Module (SIM) card 3 Yes EAP-AKA Universal SIM (U-SIM) card 2+ Yes EAP-TLS Public-Private Key based Certificate 3 Yes EAP-TTLS Public-Private Key based certificate and other 4+ Yes EAP-SRP Password 4 Yes Comparison with other Approaches:Architecture and Networking Properties Milind Buddhikot (Opensig03)

  36. Scheme Session Key Establishment Security Properties RTT to F-AAA/H-AA Path authentication Statelessness EAP-SKE Yes Yes Yes Amenable to proof EAP-SIM Yes Yes No No EAP-AKA Yes Yes No Yes EAP-TLS Yes Yes No No EAP-TTLS Depends on tunneled method Depends on Tunneled method No No EAP-SRP Yes Yes No No Comparison with other Approaches:Security Properties Milind Buddhikot (Opensig03)

  37. Conclusions • Opportunity for carriers to strengthen 3G offerings with 802.11 integration • using IETF standards (security, accounting, mobility) in 802.11 networks • 802.11 integration with CDMA 2000, GPRS/UMTS via loosely coupled approach • Benefits of simplicity, network efficiency, cost • ability to partner with 802.11 Wireless ISPs • Can be extended to support • Location services • Network based VPNs More details at http://www.bell-labs.com/user/mbuddhikot/IOTAProject/IOTA.htm Milind Buddhikot (Opensig03)

More Related