A iminente implantação do IPv6, pode ser uma solução para o crescente uso de dispositivos móveis, para ensejar a mobilidade e para solucionar problemas derivados do esgotamento de endereços IPv4. Contudo, para o provimento de mobilidade é necessário garantir conectividade ao usuário, permitindo uma utilização continuada de seus dispositivos quando em movimento, sem que ocorra a perda de conexão, de forma segura e transparente. Isto não é possível com a arquitetura TCP/IP atualmente implementada nas redes que estão operacionais, mesmo que utilizem o protocolo IPv6. Neste sentido, este trabalho visa estudar as propostas mais expressivas no provimento de mobilidade sobre IPv6, com vistas a evidenciar suas características e funcionalidades. Apresenta como resultado, uma análise desses protocolos, em especial no que tange ao tempo de troca de rede (handover) e facilidade de implementação. / The imminent deployment of IPv6, may be a solution to the growing use of mobile devices, to bring mobility and to solve problems arising from the exhaustion of IPv4 addresses. However, to provide mobility is necessary ensure connectivity for the user, allowing continued use of their devices while on the move, without loss of connection, securely and transparently. This is not possible with the TCP/IP architecture currently deployed in networks that are operating, even if used the IPv6 protocol. Thus, this work aims to study the most significant proposals in the provision of mobile IPv6, in order to contrast their features and functionalities. Presents as result, an analysis of these protocols, especially with respect to time network exchange (handover) and ease of implementation.

A iminente implantação do IPv6, pode ser uma solução para o crescente uso de dispositivos móveis, para ensejar a mobilidade e para solucionar problemas derivados do esgotamento de endereços IPv4. Contudo, para o provimento de mobilidade é necessário garantir conectividade ao usuário, permitindo uma utilização continuada de seus dispositivos quando em movimento, sem que ocorra a perda de conexão, de forma segura e transparente. Isto não é possível com a arquitetura TCP/IP atualmente implementada nas redes que estão operacionais, mesmo que utilizem o protocolo IPv6. Neste sentido, este trabalho visa estudar as propostas mais expressivas no provimento de mobilidade sobre IPv6, com vistas a evidenciar suas características e funcionalidades. Apresenta como resultado, uma análise desses protocolos, em especial no que tange ao tempo de troca de rede (handover) e facilidade de implementação. / The imminent deployment of IPv6, may be a solution to the growing use of mobile devices, to bring mobility and to solve problems arising from the exhaustion of IPv4 addresses. However, to provide mobility is necessary ensure connectivity for the user, allowing continued use of their devices while on the move, without loss of connection, securely and transparently. This is not possible with the TCP/IP architecture currently deployed in networks that are operating, even if used the IPv6 protocol. Thus, this work aims to study the most significant proposals in the provision of mobile IPv6, in order to contrast their features and functionalities. Presents as result, an analysis of these protocols, especially with respect to time network exchange (handover) and ease of implementation.

A l'origine conçus pour protéger le protocole de Découverte de Voisins (Neighbor Discovery Protocol, NDP) en IPv6, les adresses générées de manière cryptographique (Cryptographically Generated Addresses, CGA) et le protocole SEND (Secure Neighbor Discovery) doivent maintenant s'adapter au contexte de mobilité et à ses nouvelles fonctionnalités. Cette mobilité revêt de nombreuses formes : mobilité du noeud (Mobile IPv6, MIPv6), mobilité des routeurs (Network Mobility, NEMO) ou encore mobilité gérée par le réseau (Proxy Mobile IPv6). De nombreux changements doivent être opérés dans le protocole SEND : les opérations cryptographiques doivent être allégées pour les terminaux à faible capacité de calcul, les incompatibilités entre le partage d'adresse dans les protocoles de mobilité et le mécanisme de protection d'adresses de SEND doivent être corrigés, etc. Dans une première partie de cette thèse, nous présentons le protocole de Découverte de Voisins, les adresses CGA et le protocole de sécurité SEND. Nous étudions leurs limitations et, afin d'améliorer les performances, nous proposons l'utilisation de la cryptographie basée sur les courbes elliptiques (ECC). À travers une série de tests, nous mesurons l'impact de notre proposition. Par la suite, nous modifions les spécifications du protocole SEND afin de supporter de nouveaux algorithmes crytpographiques. Dans une deuxième partie, nous résolvons les incompatibilités entre le protocole SEND et les protocoles de mobilité (par ex. MIPv6) et entre le protocole SEND et les adresses anycast. Dans une dernière partie, nous présentons plusieurs contributions basées sur une utilisation dérivée des adresses CGA et du protocole SEND. / Originally designed to protect the Neighbor Discovery Protocol (NDP) (part of the IPv6 protocol suite), the Cryptographically Generated Addresses (CGA) and the Secure Neighbor Discovery (SEND) now need to be adapted to the context of Mobility and extended to new functionalities. The term "Mobility" encompasses many aspects, among them : node mobility (Mobile IPv6, MIPv6), router mobility (Network Mobility, NEMO) and network-based mobility management (Proxy Mobile IPv6, PMIPv6). Numerous changes need to be operated on the SEND protocol in order to comply with the Mobility : the cryptographic operations need to be adapted to operate on low power mobile nodes, the incompatibilities between the address sharing model of the mobile protocol and the address protections offered by SEND need to be fixed, etc. Firstly, we present the Neighbor Discovery protocol, the CGA addresses and the SEND protocol. We study their limitations, and, in order to improve their performances, we propose to replace the signature algorithm used in SEND (RSA) by the elliptic curves cryptography (ECC). We then evaluate the performances of our proposal. Subsequently, we modify the SEND protocol to include a signature algorithm selection mechanism. Secondly, we solve incompatilities between the SEND protocol and the mobility protocols (e.g. MIPv6) and between the SEND protocol and the anycast addresses. Finally, we present our contributions containing a derivate use of the CGA addresses and the SEND protocol.

Denial-of-Service (DoS) attacks form a very important category of security threats that are possible in MIPv6 (Mobile Internet Protocol version 6). This thesis proposes a scheme for participants (Mobile Node, Home Agent, and Correspondent Node) in MIPv6 to recover from DoS attacks in the event of any of them being subjected to a DoS attack. We propose a threshold based scheme for participants in MIPv6 to detect presence of DoS attacks and to recover from DoS attacks in the event of any of them being subjected to a DoS attack. This is achieved using an infrastructure for MIPv6 that makes such a solution practical even in the absence of IPsec infrastructure. We propose a protocol that uses concepts like Cryptographically Generated Addresses (CGA), short-term IP addresses using a Lamport hash like mechanism and a hierarchy based trust management infrastructure for key distribution. However, reasoning about correctness of such protocols is not trivial. In addition, new solutions to mitigate attacks may need to be deployed in the network on a frequent basis as and when attacks are detected, as it is practically impossible to anticipate all attacks and provide solutions in advance. This makes it necessary to validate solutions in a timely manner before deployment in real network. However, threshold schemes needed in group protocols make analysis complex. Model checking threshold-based group protocols that employ cryptography have been not successful so far. The testing in a real network or a test bed also will not be feasible if faster and frequent deployment of DoS mitigation solutions is needed. Hence, there is a need for an approach that lies between automated/manual verification and an actual implementation. It is evident from existing literature that not many simulations for doing security analysis of MIP/MIPv6 have been done. This research is a step in that direction. We propose a simulation based approach for validation using a tool called FRAMOGR [40] that supports executable specification of group protocols that use cryptography. FRAMOGR allows one to specify attackers and track probability distributions of values or paths. This work deals with simulation of DoS attacks and their mitigation solutions for MIP in FRAMOGR. This makes validation of solutions possible without mandating a complete deployment of the protocol to detect vulnerabilities in a solution. This does away with the need for a formal theoretical verification of a DoS mitigation solution. In the course of this work, some DoS attacks and recovery mechanisms are simulated and validated using FRAMOGR. We obtained encouraging results for the performance of the detection scheme. We believe that infrastructure such as FRAMOGR would be required in future for validating new group based threshold protocols that are needed for making MIPv6 more robust.

Current network architectures, as well as mobility management protocols, are generally deployed in a centralized manner. Moreover, these protocols are designed to be always activated, even when not needed. As the number of mobile users and the volume of their traffic increase, such centralized architectures are expected to encounter scalability issues as well as performance issues. Recently, mobile network operators are experiencing a rapid increase in mobile data traffic. In order to cope with this, a new trend is to flatten networks architectures and hence IP mobility management protocols need to be adapted for such evolution. Therefore, there is a need to define novel mobility management mechanisms that are both distributed and offered dynamically. In order to cope with this context, the thesis concerns designing, analyzing, and evaluating novel IPv6 network architectures and mobility protocols that are distributed and dynamic, and in particular Distributed Mobility Management (DMM). Before proposing any extension, we categorize the existing mobility schemes and carry out a comparative analysis on each category. Then, we propose a new distributed dynamic mobility management scheme based on the Mobile IPv6 (MIPv6) protocol, with an optional extension for the joint use with the Session Initiation Protocol (SIP). After, we carry out a performance analysis in terms of mobility costs, handover, and quality-of-service. Finally, we study the impacts on other aspects such as security considerations and location management.

This master’s thesis is focused on IP mobility support for mobile users and their devices in IPv6-based wireless networks. Then the Mobile IPv6 (MIPv6) protocol was proposed for this purpose and that is also the main objective of the thesis. This consists of several basic sections and is organized as follows: The first one deals with the overview of the function of Mobile IP, which enables the mobility of nodes around the Internet, without a change of their original IP address. Moreover there are introduced the primary differences between MIPv6 and its previous version – i.e., MIPv4, proposed for IPv4-based environment. The second chapter of the master’s thesis thereafter describes detailed information about all the most important mechanisms and features of Mobile IPv6 and this way tries to explain principles of its functioning. Further the thesis analyses some of proposed MIPv6 extensions – i.e., Hierarchical Mobile IPv6 (HMIPv6), Mobile IPv6 Fast Handover (FMIPv6) a Fast Handover for HMIPv6 (F-HMIPv6) protocols, and mainly aim at signaling process during the handover of a mobile node. In the last main section of the master’s thesis an analytical method to evaluate the performance of IPv6-based mobility management protocols was proposed. Subsequently, this method is applied on the protocols which were mentioned above and are studied the effects of various network parameters on the performance of these protocols.

No description available.