Secure Routing and Mobility in Future IP Networks

Introduction

In mobile networking two fundamental features require new security solutions. The first fundamental feature is that the network infrastructure is no longer fixed. Home network protection can therefore no longer rely on network border defense, such as network traffic control in network gateways, since network borders can no longer be defined. Moreover, authentication and authorization solutions can no longer be based on network host location, for example defined by an IP address, since network host location changes cannot be predicted.

The second fundamental feature requiring new security solutions is the presence of wireless links in mobile networks. Secure communication in mobile networks can therefore no longer be based on protection and isolation of the communication media. The wireless links in mobile networks are not only end user node connections to the network. Also an entire network, for example a wired or wireless network in a train, can have changing wireless attachments to other networks. A network with a fixed structure to which mobile nodes and/or mobile networks are attached is called a mobile infrastructure network. Another mobile network type is a mobile ad hoc network (MANET) in which all network links are both wireless and changing.

This book chapter is a state of the art survey of

• •

  security requirements,

• •

  security architecture,

• •

  routing security, and

• •

  security of mobility management protocols

in present and future mobile networks.

Security Requirements In Mobile Networks

Security is of most important concern when providing Internet mobility support. Any mobility solution must provide protection itself against attacks on and misuses of mobility features and mechanisms. Examples are stealing of legitimate addresses and flooding a node with a large amount of unwanted traffic. Complete and useful Internet mobility should address the security issues.

The following security requirements for a mobile infrastructure network type called 4G mobile networks with mobile end user devices are proposed in (Zheng et al., 2005), when end user devices called Mobile Equipment (ME) have location mobility and USIMs (Universal Subscriber Identity Module) as security modules:

• 1.

  Security requirements on an ME/USIM:

  • •

    It shall protect the integrity of the hardware, software and OS in the mobile platform

  • •

    It shall control access to data in ME/USIM.

  • •

    It shall ensure confidentiality and integrity of data stored in the ME/USIM or transported on the interface between ME and USIM.

  • •

    It shall retain user’s identity as privacy to ME.

  • •

    It shall prevent the stolen/compromised ME/USIM from being abused and/or used as an attack tool.

• 2.

  Security requirements on radio interface and network operator:

  • •

    Entity authentication: mutual authentication between user and network shall be implemented to ensure secure service access and provision.

  • •

    Ensure confidentiality of data including user traffic and signaling data on wired or wireless interface.

  • •

    Ensure integrity and origin authentication of user traffic, signaling data and control data.

  • •

    Security of user identity: It shall protect user identity confidentiality, protect user location confidentiality and prevent user traceability.

  • •

    Lawful interception: It shall be possible for law enforcement agencies to monitor and intercept every call in accordance with national laws.

• 3.

  Security visibility, configurability and scalability:

  • •

    The security features of the visited network should be transparent to the user.

  • •

    The user can negotiate acceptable security lever with the visited network when user roams outside HE (home environment).

  • •

    The security mechanism shall be scalable to support increase of user and/or network elements.