輔大資工所 在職研一 報告人：林煥銘 學號： Public Access Mobility LAN: Extending The Wireless Internet into The LAN Environment Jun Li, Stephen B. Weinstein, Junbiao Zhang, And Nan Tu NEC USA Inc.

P.2 Presented by Herman Lin Outline Introduction Architecture & Protocol Components Security Issues Mobility Management Conclusion

P.3 Presented by Herman Lin Introduction PamLAN: Public Access Mobility LAN Aim is to meet Ubiquitous access High data rate Local services demands Architectural guidelines for WLAN environments Large-scale IP-based Supporting mobile/portable appliances (Simultaneously support different air interfaces)

P.4 Presented by Herman Lin Introduction (cont’d) Based on wired LAN environment Wireless access points are imbeded Multi-segment LAN Supporting handoffs

P.5 Presented by Herman Lin Introduction (cont’d) Supports Internet Access via WLANs Multiple air interfaces Multiple virtual operators Location dependent services Local IP mobility QoS (within wired network)

P.6 Presented by Herman Lin Introduction (cont’d) The main disadvantage of current WLANs Lack of public access Being tied down to a single access point (i.e.,restriction to subscribers of the WLAN operator) Single air interface (reducing the range of appliances) Not a breakthrough in technological capacities Combination of available technologies

P.7 Presented by Herman Lin Architecture PamLANMultiple virtual operators, each operation a VOLAN, AAA features. VOLANVirtual operator LAN, extending VLAN capabilities across subnetworks for each virtual operator. VLANVirtual LAN, implementing user group features such as broadcast containment within a physical LAN. Table 1. PamLAN/VOLAN/VLAN hierarchy.

P.8 Presented by Herman Lin Architecture (cont’d) Switched Ethernet LAN Access Points Supporting IEEE, Bluetooth, Cellular,... IP-based access router with proxies Gateway routers Internet access through IP-tunneling

P.9 Presented by Herman Lin Architecture (cont’d)

P.10 Presented by Herman Lin Architecture (cont’d) Integration of Cellular IP & Mobile IP for supporting mobility MPLS (Multi-Protocol Label Switching) Brings QoS across multiple LAN segments IEEE VLAN standard 802.1Q IEEE 802.1p header for QoS

P.11 Presented by Herman Lin Large Scale PamLAN For single VLAN QoS can be easily supported For large scale WLANs? Intermediate routers work at layer 3 Source & destination addresses must be used for VOLAN membership Intermediate routers must know all IP addresses for VLAN mapping VLAN for grouping traffic per VOLAN MPLS for whole PamLAN

P.12 Presented by Herman Lin MPLS (Multi-Protocol Label Switching) Tunnels traffic between gateways & access points Intermediate routers only examine MPLS labels, which imposes a path Forwarding Equivalence Class (FEC) Formed based on VOLAN membership & QoS FEC is inserted in MPLS label Used for 802.1p priority within VLAN

P.13 Presented by Herman Lin MPLS (cont’d)

P.14 Presented by Herman Lin MPLS (cont’d) Traffic engineered paths can be set up among access points and Internet gateways according to service contracts between PamLan & virtual operators DiffServ QoS service: IEEE 802.1p & MPLS traffic engineering

P.15 Presented by Herman Lin Protocol Stack

P.16 Presented by Herman Lin Security Issues Four major components: Mutual Authentication Secure Channel Establishement Per packet encryption Filtering function

P.17 Presented by Herman Lin Security Issues RADIUS client DHCP Filter User’s Profile ： Public Key Subscription status

P.18 Presented by Herman Lin Mutual Authentication RADIUS (Remote Authentication Dial-In User Service) IP-based authentication (~ proposal) Basic Steps: Obtaining IP (DHCP) Login session access point: relay agent to virtual operator Challenge-responce protocol for authentication Send the user’s profile

P.19 Presented by Herman Lin Securing Channel Establishment After authentication User’s profile is transfered to the access point including his/her public key Access point sends session key encrypted under the corresponding public key IPSec together with ESP can be used for security at IP layer depending on user requests

P.20 Presented by Herman Lin Authorization Control Based on user credentials, packets can be filtered at the access point Through (authenticated with the session key) Sent to the authentication engine (login in) Blocked (unauthorized traffic)

P.21 Presented by Herman Lin Mobility Issues Mobility should be supported at layer 3 Multiple subnetworks within PamLAN Micromobility Roaming within PamLAN

P.22 Presented by Herman Lin Mobility Issues (cont’d) Possible approaches Cellular IP: Routing update message is sent from mobile device New AP, each router along the way, gateway update their routing table The mobile device periodically send paging packets The process is burden when a large number of mobile devices being served MPLS based: only end points have to update location Old, new access points and Internet gateway need to be informed

P.23 Presented by Herman Lin Cellular IP

P.24 Presented by Herman Lin Cellular IP Routing update Routing entries are refreshed periodically

P.25 Presented by Herman Lin Mobility Issues (cont’d) Fast AAA handoff No repetative authentication Move user profile from old access point to the new one(contain public key, old session key, mobile device IP, old session’s access policy) Old AP signals to the RADIUS server terminate the current accounting session New AP generates a new session key New AP sends old session key and new session key encrypted under user’s public key User uses the new session key to establish a secure connection with the new AP

P.26 Presented by Herman Lin Fast AAA handoff Contains : user’s public key, old session key, mobile device’s IP, access policy…. Fetch the profile old APnew AP

P.27 Presented by Herman Lin The old AP signals to the RADIUS server the termination of the current accounting session. old APnew AP Fast AAA handoff

P.28 Presented by Herman Lin Encrypts new session key and old session key using public key and send the result to the user in a UDP packet old APnew AP New session key + Old session key Fast AAA handoff

P.29 Presented by Herman Lin The mobile deveice decrypts these keys and compares the old session key old APnew AP New session key Establish a secure connection Fast AAA handoff

P.30 Presented by Herman Lin Conclusion Secure Economical Extensible Multiple service providers Multiple air interfaces Variety of services appropriate for coming generations of Internet appliances.

P.31 Presented by Herman Lin Reference