Re: [nbs] NBS and TCP connection identification

[Christian Vogt <[e-mail]>]

Javier Ubillos wrote:

>> How do you secure the movement in that case?
>> Suppose the client has IP address 129.146.228.81, thus the server would 
>> see the client as having name 81.228.146.129.in-addr.arpa.
>> Then the client switches to being on IP address 36.1.2.3. How can you 
>> know that it is indeed the same client so that it is secure for the 
>> server to start sending the packets to 36.1.2.3?
>> You can't rely on DNS validation (unless you assume that the client can 
>> update the DNS records for 81.228.146.129.in-addr.arpa, which is very 
>> unlikely.)
>> Thus how do you secure this?
> 
> Movement is, in the name-based sockets + shim6, handled by shim6.
> The shim6 handshake is performed out-of-band. Before that is done, no
> mobility/multi-homing is available. Shim6 deals with validation. We do
> add locators to be tested found in DNS, but AFAIKT shim6 deals with this
> nicely, and yes, we cannot trust DNS to that extent.


Erik,

let me add that the selection of Shim6 for mobility management was an implementation decision, not a conceptual decision:  We had an existing Shim6 implementation and people familiar with this implementation, so it seemed naturally to build upon it.  Conceptually, one could devise name-based sockets to work without Shim6.

Specifically, we are re-using Shim6's mechanisms for movement detection and address updating.  We do not re-use Shim6's mechanisms for binding IP addresses together, since with name-based sockets, IP addresses are bound to DNS names rather than to each other.

- Christian