Download presentation
Presentation is loading. Please wait.
1
Robert Moskowitz, Verizon
March 2012 Project: IEEE P Working Group for Wireless Personal Area Networks (WPANs) Submission Title: KMP Transport Proposal Date Submitted: March 15, 2012 Source: Robert Moskowitz, Verizon Address 1000 Bent Creek Blvd, MechanicsBurg, PA, USA Voice:+1 (248) , Re: Key Managementn over 4e Multipurpose Frames Abstract: Proposal for tg9 document structure and content Purpose: To add Key Management capabilities to 15.4 and 15.7 Notice: This document has been prepared to assist the IEEE P It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study. The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein. Release: The contributor acknowledges and accepts that this contribution becomes the property of IEEE and may be made publicly available by P Robert Moskowitz, Verizon
2
Key Management Support for 15.4 and 15.7
March 2012 Key Management Support for 15.4 and 15.7 Robert Moskowitz Waikoloa, HI March 15, 2012 Robert Moskowitz, Verizon
3
Changes from prior Version
March 2012 Changes from prior Version Change IE format to 'multipurpose' chaining Add 1 byte to KMP fragment to identify which KMP for the KMP multipurpose IE. Robert Moskowitz, Verizon
4
March 2012 Abstract To provide for a Key Management Protocol Transport for and .7 KMP agnostic Support: HIP, IKEv2, 802.1X, ... Provide recommended functionality for KMPs Use Information Elements From 15.4e for 15.4 How for 15.7? Robert Moskowitz, Verizon
5
KMP Transport Frames and State Machine
March 2012 KMP Transport Frames and State Machine Fragmentation Support KMP packet size WILL exceed MPDU Forced fragment chaining for simplification Concurrent KMP sessions Security Association content What keys? PTK, GTK, etc. Counters, lifetimes, etc. Robert Moskowitz, Verizon
6
15.4 Specifics 15.4 MAC and IE formats March 2012
Robert Moskowitz, Verizon
7
KMP Information Element
March 2012 KMP Information Element Frame format MAC specific content ID Length Control Field – 1 byte KMP fragment Bits:1 7 Octets: Chaining Flag MultiID/Count KMP Fragment 0-1 0-127 -- Robert Moskowitz, Verizon
8
KMP Transport Frames and State Machine
March 2012 KMP Transport Frames and State Machine Control Field 1 bit chaining flag (yes, last/onlyone) 7 bit Multipurpose ID/Chain count First packet provides Multipurpose ID ID range , 97 & 127 reserved ID=98 for KMP Chain Count Ends at 96 to disambiguate ID from count C=1 is 1st fragment C=2 is 2nd fragment 96 fragments SHOULD provide for at least 6KB KMP payload Robert Moskowitz, Verizon
9
KMP Transport Frames and State Machine
March 2012 KMP Transport Frames and State Machine KMP fragment KMP ID – 1 byte 802.1X, HIP, IKEv2, SAE, etc. KMP payload Robert Moskowitz, Verizon
10
15.4 Specifics 15.4 MAC and IE formats March 2012
Robert Moskowitz, Verizon
11
15.4 Specifics Use 15.4e Information Elements
March 2012 15.4 Specifics Use 15.4e Information Elements Use data payload IEs (not header IEs) Larger payload length Header IEs limited to 127 bytes Need IE type assignment MLME Nested limited to 255 bytes Only 5 values available Robert Moskowitz, Verizon
12
15.4 Specifics MAC and IE details IE ID Value assignment March 2012
Only 5 values available Thus the move to a 'multipurpose' chain ID with sub-field for KMP IDs Thus similar to MLME (Nested) but as a data IE Robert Moskowitz, Verizon
13
15.4 Specifics MAC and IE details
March 2012 15.4 Specifics MAC and IE details Unauthenticated PDUs always use long addresses e.g. KMP rekeying within authenticated PDUs MAY use short addresses Use Forced ACK for chaining support For pre-4e devices work with IETF on 6lowpan support Robert Moskowitz, Verizon
14
15.4 Specifics MAC and IE details ACK frame used for chaining
March 2012 15.4 Specifics MAC and IE details ACK frame used for chaining Robert Moskowitz, Verizon
15
15.4 Specifics Pre 15.4e device support For 6lowpan PANs March 2012
Develop a submission to the IETF using the Dispatch Type in RFC 4944 PDUs with the KMP Dispatch Type a length field will be equivalent to the 15.4e KMP IE A 6lowpan device that supports 15.4e SHOULD also support this pre-15.4e mode of operation Who wants to author this? Robert Moskowitz, Verizon
16
15.4 Specifics Security Association content
March 2012 15.4 Specifics Security Association content section 7.5, table 60 SA per link pair Broadcast SA(s) may be KMP specific 1 per source? Shared key space with sequence including source MAC? How to control rekeying will be KMP specific Robert Moskowitz, Verizon
17
15.7 Specifics Use 15.7 Information Element Command
March 2012 15.7 Specifics Use 15.7 Information Element Command Can a Command frame ONLY have IEs? Sec 5.3 seems to indicate that the MLME has no way to construct a command frame with ONLY IEs. Need Element ID assignment Use Forced ACK for chaining support Robert Moskowitz, Verizon
18
15.7 Specifics Use 15.7 Information Element Command March 2012
Robert Moskowitz, Verizon
19
15.7 Specifics Use 15.7 Information Element Command
March 2012 15.7 Specifics Use 15.7 Information Element Command Need Element ID assignment Robert Moskowitz, Verizon
20
15.7 Specifics Use 15.7 Information Element Command
March 2012 15.7 Specifics Use 15.7 Information Element Command IE length of 255 bytes max may be too limited IE Command allows for multiple IEs per command KMP IE MAY have larger IE? Robert Moskowitz, Verizon
21
15.7 Specifics Use 15.7 Information Element Command
March 2012 15.7 Specifics Use 15.7 Information Element Command IE payload same as in 15.4 ACK frame used for chaining Robert Moskowitz, Verizon
22
15.7 Specifics Security Association content
March 2012 15.7 Specifics Security Association content section 7.5, table 66 Needs study SA per link pair Broadcast SA(s) may be KMP specific 1 per source? Shared key space with sequence including source MAC? How to control rekeying will be KMP specific Robert Moskowitz, Verizon
23
KMP Guidelines KMP Sections General KMP description Use case(s)
March 2012 KMP Guidelines KMP Sections General KMP description Sub sections as needed, e.g. backend authentication mechanism Use case(s) Profile References to defining documents Parameter specifics, e.g. in HIP, K=0 SA definition E.G. Tie into security PID Robert Moskowitz, Verizon
24
KMP Guidelines Initial list of KMPs 802.1X
March 2012 KMP Guidelines Initial list of KMPs 802.1X Needs to include an actual key exchange like the i 4-way handshake HIP – R. Moskowitz/J. Haapola IKEv2 – T. Kivinen PANA – Yoshihiro Ohba SAE Robert Moskowitz, Verizon
25
KMP Guidelines KMP Profiling for 15.9 usage Change in encapsulation
March 2012 KMP Guidelines KMP Profiling for 15.9 usage Change in encapsulation e.g. IKEv2 specified to run over UDP Additions for SA management e.g X does not supply link keys. In usage, this is done via the 4- Way Handshake Special attention to broadcast keying management Others? Robert Moskowitz, Verizon
26
KMP Guidelines KMP use cases Why this KMP? Practical examples
March 2012 KMP Guidelines KMP use cases Why this KMP? Code size, CPU/battery demand Multi-layer code reuse Practical examples Deployment advice Identity installation and registration When performed Life-cycle management Rekeying Robert Moskowitz, Verizon
Similar presentations
![May 2018 Project: IEEE P802.15 Working Group for Wireless Personal Area Networks (WPANs) Submission Title: [Considerations on general MAC frame] Date Submitted:](/90/14787937/big_thumb.jpg "May 2018 Project: IEEE P802.15 Working Group for Wireless Personal Area Networks (WPANs) Submission Title: [Considerations on general MAC frame] Date Submitted:>")
