1 / 10

Key Management over 4e Multipurpose Frames

This submission proposes using 4e Multipurpose Frames to add Key Management capabilities to the IEEE 802.15.4 standard. It discusses the use of HIP, IKEv2, and 802.1X protocols and explores the inclusion of Information Elements and short addresses in KMP frames. The submission also considers KMP deployment in both beaconless PANs and beacon PANs, as well as HIT discovery and defense against Diffie-Hellman MITM attacks. Moving forward, the submission suggests creating a Recommended Practice document for KMP support in 802.15.4 and exploring collaboration with the IETF to protect IPv6 Neighbor Discovery.

pavery
Download Presentation

Key Management over 4e Multipurpose Frames

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Robert Moskowitz, Verizon Project: IEEE P802.15 Working Group for Wireless Personal Area Networks (WPANs) Submission Title: Key Management over 4e Multipurpose Frames Date Submitted: May 10, 2011 Source: Robert Moskowitz, Verizon Address 1000 Bent Creek Blvd, MechanicsBurg, PA, USA Voice:+1 (248) 968-9809, e-mail: rgm@labs.htt-consult.com Re: Key Managementn over 4e Multipurpose Frames Abstract: Using 4e Multipurpose Frames to provide for Key Mangement Purpose: To add Key Management capabilities to 15.4 Notice: This document has been prepared to assist the IEEE P802.15. It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein. Release: The contributor acknowledges and accepts that this contribution becomes the property of IEEE and may be made publicly available by P802.15.

  2. Robert Moskowitz San Francisco July 19, 2011 Key Management over 15.4e Multipurpose Frames Robert Moskowitz, Verizon

  3. Robert Moskowitz, Verizon Abstract • To provide for a Key Management Protocol for 802.15.4 • KMP agnostic • Support: HIP, IKEv2, 802.1X, ... • Use the new Multipurpose Frames added via 15.4e for the transport of the KMP frames • Also Command Frames

  4. Robert Moskowitz, Verizon Discussion • 4e Multipurpose Frame • Adds flexibility to 15.4 • New functions without major standards revisions • Provides for Information Elements • Basic TLV – Type/Length/Value

  5. Robert Moskowitz, Verizon Discussion • KMP Information Element • KMP type 4bits (HIP, IKEv2, 802.1X) • Chaining flag 2 bits (no, yes, last) • Chaining REQUIRES frame ack • Chain count 6bits (multiple frames per KMP packet) • KMP payload • For HIP see IETF 5201-bis and HIP-DEX

  6. Robert Moskowitz, Verizon Discussion • Short address for KMP frames (when HIP is KMP) • I1 always uses long addresses • HITs used derive short addresses • Low order 16 bits? • How to handle collisions? • Include short addresses in R1 over long addresses, THEN I2 over short addresses to handle collisions?

  7. Robert Moskowitz, Verizon Discussion • BEACONLESS PANs are commonly deployed and thus first step in participation would be to KMP over Multipurpose frames. • BEACON PANs use ASSOCIATE Command Frames to start participation. • These frames can contain IEs so they would be used for KMP transport.

  8. Robert Moskowitz, Verizon Discussion • HIT discovery and defense from Diffie-Hellman MITM attacks • Assume Initiator has no knowledge of Responders HIT for I1, so use I1 opportunistic mode (no Responder HIT) • Responder authenticates Initiator HIT • Pre-configured ACL • Restricted time window

  9. Robert Moskowitz, Verizon Moving Forward • Create 802.15.4 Recommended Practice document for KMP support as outlined • Include HIP DEX, IKEv2, and 802.1X guidelines • Allow for other KMPs defined elsewhere

  10. Robert Moskowitz, Verizon Moving Forward • Work with IETF with 'mess under' to support KMP within a 15.4 mess? • E.G. to protect IPv6 Neighbor Discovery

More Related