Re: [nbs] NBS and TCP connection identification

[Steven Blake <[e-mail]>]

On Mon, 2010-09-27 at 15:20 -0700, Christian Vogt wrote:

> Erik Nordmark wrote:
> 
> > How do you secure the movement in that case?
> > Suppose the client has IP address 129.146.228.81, thus the server would 
> > see the client as having name 81.228.146.129.in-addr.arpa.
> > Then the client switches to being on IP address 36.1.2.3. How can you 
> > know that it is indeed the same client so that it is secure for the 
> > server to start sending the packets to 36.1.2.3?
> > You can't rely on DNS validation (unless you assume that the client can 
> > update the DNS records for 81.228.146.129.in-addr.arpa, which is very 
> > unlikely.)
> > Thus how do you secure this?
> 
> 
> Erik,
> 
> a way to secure IP address changes without the help of Shim6 would be the following:
> 
> - Exchange a randomly generated token at the old IP address.
> 
> - Verify the peer's knowledge of this token at the new IP address.
> 
> - Upon successful verification, associate the peer's new IP address with the peer's DNS name, which happens to encode the IP address that the peer had used during session initiation.
> 
> This procedure would be very similar to the Mobile IPv6 care-of address check.

Also very similar to the principle behind the ILNP nonce option:

http://tools.ietf.org/html/draft-rja-ilnp-nonce-06


Regards,

/////////////////////////////////////////////
Steven Blake       [e-mail]
Extreme Networks              [phone]