Mobility Support in IPv6
obsoletes
- rfc-3775 — Mobility Support in IPv6
Extracted elements (32)
Binding Updates to correspondent nodes use the return routability procedure rather than pre-arranged security associations because no authentication infrastructure between arbitrary mobile nodes and correspondent nodes can be assumed. The procedure operates on a global scale without prior configuration.
Mobile IPv6 eliminates the need for 'foreign agents' required by Mobile IPv4, operating in any location without special support from the local router. Route optimization is a fundamental, standardized part of the protocol rather than a nonstandard extension, enabling global deployment.
Most route-optimized packets use an IPv6 routing header rather than IP-in-IP encapsulation (as in Mobile IPv4), reducing per-packet overhead. This also eliminates the need to manage 'tunnel soft state' and decouples the protocol from link-layer specifics by relying on IPv6 Neighbor Discovery instead of ARP.
Nonce indices are included in the protocol to allow correspondent nodes to efficiently find the nonce used in creating a keygen token without storing per-mobile-node state. The correspondent node creates no mobile-node-specific state until it receives a Binding Update, keeping the RR procedure stateless at the CN side.
Mobile IPv6 route optimization is designed to coexist with routers performing ingress filtering. When sending packets from the care-of address with a Home Address destination option, the source address in the IP header is the care-of address (which passes ingress filtering), while the home address is carried in the extension option.
Bindings established with correspondent nodes using keys derived from the return routability procedure MUST NOT exceed MAX_RR_BINDING_LIFETIME seconds. Additionally, when using an Alternate Care-of Address option, the Care-of Test MUST have been performed for that alternate address, and the nonce indices and MAC MUST be based on that test.
Correspondent nodes MUST NOT accept nonces beyond MAX_NONCE_LIFETIME seconds after their first use. Expired nonce values MUST be discarded, and messages using stale or unknown nonce indices will be rejected.
Home and care-of addresses MUST be unicast routable addresses. Unique-local IPv6 unicast addresses (ULAs) SHOULD NOT be used as home or care-of addresses when other address choices are available, because ULAs at a foreign site cannot successfully reach the mobile node's home agent.
Manual configuration of IPsec security associations MUST be supported. Shared secrets MUST be random, unique for different mobile nodes, and MUST be distributed off-line. IKEv2 automatic key management MAY be supported.
Mobility Header messages MUST NOT be sent with a type 2 routing header (except for Binding Acknowledgement per Section 9.5.4) and MUST NOT be used with a Home Address destination option (except for Binding Update per Sections 11.7.1 and 11.7.2). Binding Cache/Update List state MUST NOT be used when sending Mobility Header messages.
Return Routability signaling MUST be sent to the correspondent node's home address (not its care-of address) if the correspondent node is mobile. If Return Routability signaling times out after MAX_RO_FAILURE attempts, the mobile node MUST revert to sending packets through its home agent.
The correspondent node's secret node key (Kcn) MUST be a random number exactly 20 octets in length and MUST NOT be shared with any other entity. It is used to produce keygen tokens for the return routability procedure.
The length of the Mobility Header MUST be a multiple of 8 octets. The Mobility Header MUST be aligned on an 8-octet boundary. The Reserved fields MUST be initialized to zero by the sender and MUST be ignored by the receiver.
The mobile node and home agent MUST use an IPsec security association to protect Binding Updates and Acknowledgements. Both MUST support and SHOULD use ESP in transport mode with a non-NULL payload authentication algorithm to provide data origin authentication, connectionless integrity, and optional anti-replay protection.
The mobile node and home agent SHOULD use an IPsec security association to protect Mobile Prefix Solicitations and Advertisements. Both MUST support and SHOULD use ESP in transport mode with a non-NULL payload authentication algorithm.
Binding Acknowledgement (MH Type 6) acknowledges receipt of a Binding Update when acknowledgement was requested or an error occurred. It carries a Status code, sequence number, and lifetime. A Binding Authorization Data option with MAC is required when sent to a mobile node that used the return routability procedure.
Binding Update (MH Type 5) notifies a correspondent node or home agent of a mobile node's current care-of address. When sent to the home agent it is marked as a home registration. The message includes a sequence number, lifetime, flags (H=home registration, A=acknowledgement requested, L=link-local address compat, K=key management), and optional mobility options.
Dynamic Home Agent Address Discovery uses two new ICMP message types (Home Agent Address Discovery Request and Reply) to allow a mobile node away from home to discover the IP address of a home agent on its home link. No security is provided for this mechanism by design.
The Home Address destination option carries a mobile node's home address in packets sent from its care-of address, making the care-of address transparent to upper layers. Its use is restricted to cases where the correspondent node already has a Binding Cache entry for the given home address, preventing address-spoofing attacks.
The Mobility Header is a new IPv6 extension header (Next Header value 135) used for all Mobile IPv6 signaling. It carries eight message types: Binding Refresh Request, Home Test Init, Care-of Test Init, Home Test, Care-of Test, Binding Update, Binding Acknowledgement, and Binding Error.
The return routability procedure consists of four messages (HoTI, CoTI, HoT, CoT) exchanged between the mobile node and correspondent node. It verifies reachability at both the home address and care-of address, producing keygen tokens that the mobile node combines via SHA-1 into the binding management key Kbm = SHA-1(home keygen token | care-of keygen token).
The Type 2 Routing Header is a new IPv6 routing header variant used by correspondent nodes to route packets directly to a mobile node's care-of address while carrying the home address as the ultimate destination. It allows route optimization without IP-in-IP encapsulation overhead.
IANA maintains the Mobility Header message type registry (MH Type field, 8-bit). Values 0-8 are assigned by this document (BRR, HoTI, CoTI, HoT, CoT, BU, BA, BE, and one additional). New values require IETF Review or IESG Approval.
IANA maintains the Mobility Options registry (TLV type values for options carried within Mobility Header messages). Options defined in this document include Pad1, PadN, Binding Refresh Advice, Alternate Care-of Address, Nonce Indices, and Binding Authorization Data.
Home keygen tokens are encrypted as they are tunneled from the home agent to the mobile node (Section 10.4.6), protecting them against passive on-path inspection. The Home Address option is restricted to packets where a valid binding cache entry exists, preventing it from being used to redirect arbitrary traffic.
The home agent MUST check that a given home address is associated with the correct security association to prevent a mobile node from sending a Binding Update on behalf of another mobile node sharing the same home agent. The security policy database entries must unequivocally identify a single SA per home address/home agent pair.
The return routability procedure limits potential Binding Update attackers to those with on-path access between the home network and the correspondent node. Off-path attackers cannot forge Binding Updates because they cannot intercept the keygen tokens sent to both the home address and care-of address.
Movement detection triggers a state change from 'at home' to 'away from home': the mobile node detects L2 or L3 handover, forms a new care-of address, sends Binding Update to home agent (home registration), optionally performs return routability with correspondent nodes, then transitions to route-optimized or bidirectional-tunneled communication. Returning home triggers de-registration by sending BU with lifetime=0.
Keygen tokens are 64-bit values computed as: home keygen token = First(64, HMAC_SHA1(Kcn, home_address | nonce | 0x00)); care-of keygen token = First(64, HMAC_SHA1(Kcn, care_of_address | nonce | 0x01)). The Kbm = SHA-1(home keygen token | care-of keygen token), producing a 20-octet binding management key.
The Binding Authorization Data option carries a 96-bit MAC computed as First(96, HMAC_SHA1(Kbm, care_of_address | correspondent | MH_Data)). This authenticates Binding Updates and Binding Acknowledgements between mobile nodes and correspondent nodes.
The Home Test Init message (MH Type 1) carries a 16-bit Reserved field followed by a 64-bit Home Init Cookie (random value). The Care-of Test Init (MH Type 2) has the same structure with a 64-bit Care-of Init Cookie. Header Len is set to 1 when no options are present.
The Mobility Header has a fixed 8-octet header: Payload Proto (8-bit, Next Header value of following header), Header Len (8-bit, length in 8-octet units excluding first 8 octets), MH Type (8-bit), Reserved (8-bit, zero), Checksum (16-bit one's complement), followed by variable-length Message Data.