Mobile IPv6 Operation with IKEv2 and the Revised IPsec Architecture
updates
- rfc-3776 — Using IPsec to Protect Mobile IPv6 Signaling Between Mobile Nodes and Home Agents
Extracted elements (31)
Anti-replay protection via ESP sequence numbers is optional for Binding Updates because sequence numbers in the BU itself provide anti-replay. However, complete anti-replay protection can only be guaranteed by dynamic keying (IKEv2), since SA state may be lost on a home agent reboot.
Per-interface configuration of security policies is no longer required for protecting mobility header messages because the Mobility Header message type can now be used directly as a selector. Without per-interface policies, however, payload packet protection is limited to packets originating or terminating at the home address.
The revised IPsec architecture (RFC 4301) expanded selectors to include Mobility Header message type and ICMPv6 message type and code, making it easier to differentiate between individual mobility header messages without requiring per-interface security policy configuration as RFC 3776 did.
IPsec implementations lacking fine-grain selectors such as Mobility Header message type and ICMPv6 message type are compatible with this document but are not compliant with RFC 4301. Coarser implementations can use protocol-level or tunnel-all approaches as described in Section 5.
When all tunneled traffic is protected by a single IPsec SA (selector set to 'any'), that SA MUST fulfill the confidentiality requirements for Return Routability messages. Special handling is needed so that a Binding Update updating the tunnel endpoint is not dropped while the SA endpoint is being changed.
ESP encapsulation for Binding Updates and Binding Acknowledgements MUST be supported and used.
ESP encapsulation in tunnel mode for HoTi and HoT messages tunneled between the mobile node and the home agent MUST be supported and SHOULD be used.
ESP encapsulation of ICMPv6 messages related to mobile prefix discovery MUST be supported and SHOULD be used.
If the home address is dynamically assigned as described in Section 9, the home agent MUST associate the home address with the identity used in IKE negotiation to prevent address hijacking.
If the home agent is unable to allocate a home address during IKE_AUTH, it MUST send a Notify Payload with INTERNAL_ADDRESS_FAILURE; on receipt, the mobile node SHOULD terminate the IKE_AUTH exchange.
If the mobile node or home agent does not support IKE endpoint mobility capability and has no other means to update addresses, then an IKEv2 exchange MUST be initiated to re-establish a new IKE SA after a care-of address change.
Mobile IPv6 implementations MUST use the Alternate Care-of Address mobility option in Binding Updates sent by mobile nodes while away from home, in order to prevent tampering with the care-of address outside the ESP-protected region.
The EAP-generated shared key, if used to generate AUTH payloads in IKEv2, MUST NOT be used for any other purpose.
The home agent MUST be able to prevent a mobile node from using its security association to send a Binding Update on behalf of another mobile node. With manual IPsec configuration, the home agent MUST verify that an SA was created for a particular home address; with dynamic keying, the home agent MUST verify the IKE_AUTH identity is authorized for that home address.
The home agent MUST set the new care-of address as the destination address of tunnel packets after an accepted Binding Update changes the care-of address, and similarly starts to expect the new source address in tunnel packets from the mobile node.
The home agent MUST use the Type 2 Routing header in Binding Acknowledgements and Mobile Prefix Advertisements sent to the mobile node when transport mode IPsec protection is used.
The mobile node and home agent MUST create security associations based on the home address so that SAs survive changes in care-of address; when using IKEv2, the home address should be carried as the initiator IP address in the TSi payload during CREATE_CHILD_SA exchange.
The mobile node MUST use its care-of address as source address in protocol exchanges when using dynamic keying.
The mobile node MUST use its home address as the initiator IP address in the TSi payload in the CREATE_CHILD_SA exchange in order to create IPsec SAs bound to the home address.
The mobile node MUST use the Home Address destination option in Binding Updates and Mobile Prefix Solicitations when transport mode IPsec protection is used, so that the home address is visible during IPsec policy checks.
Tunnel mode IPsec ESP MUST be supported and SHOULD be used for protection of return routability procedure packets; a non-null encryption transform and a non-null authentication algorithm MUST be applied.
When a packet destined to the receiving node is matched against IPsec security policy or SA selectors, an address appearing in a Home Address destination option is considered as the source address of the packet.
When EAP is used and the mobile node's actual identity is carried inside EAP and not visible in the IDi field, the home agent MUST acquire the mobile node's identity from the corresponding AAA server.
When PKI-based authentication is used and the mobile node presents its home address in the IDi payload, the home agent MUST verify that the home address matches the address in an iPAddress field in the SubjectAltName extension of the certificate.
When securing Binding Updates, Binding Acknowledgements, and Mobile Prefix Discovery messages, both mobile node and home agent MUST support ESP in transport mode and MUST use a non-null payload authentication algorithm to provide data origin authentication, connectionless integrity, and optional anti-replay protection.
Dynamic home address configuration uses the IKEv2 Configuration Payload: the mobile node includes a zero-length INTERNAL_IP6_ADDRESS attribute in a CFG_REQUEST; the home agent replies in CFG_REPLY with a 128-bit home address plus prefix length. The home address lifetime is tied to the IKEv2 SA lifetime.
The Mobility Header message type is negotiated in IKEv2 by placing it in the most significant eight bits of the 16-bit local 'port' selector in TSi/TSr payloads during the IKEv2 exchange.
The Peer Authorization Database (PAD) is used by the home agent to store per-mobile-node state, including authentication credentials and the binding between a mobile node's identity and its home address. In dynamic home address assignment, a temporary PAD entry links the authenticated peer identity to the newly allocated home address.
A misbehaving mobile node could create IPsec SAs for a home address belonging to another mobile node. The home agent must verify that a mobile node is authorized to use a given home address before creating SAs for it, and must associate dynamically assigned home addresses with the authenticated IKE identity.
Address modifications to IPsec SA tunnel endpoints MUST only be performed based on Binding Updates received and protected by IPsec. Modifications based on other sources (e.g., unprotected BUs to correspondent nodes, or open API access) may introduce security vulnerabilities.
When the mobile node returns home and de-registers, the tunnel between HA and care-of address is torn down. SPD entries for tunneled traffic SHOULD be made inactive; SAs for BU/BAck/MPD SHOULD NOT be deleted. Manually-configured SAs MUST be retained for reuse when the MN moves away again.