IEEE 802.21 MEDIA INDEPENDENT HANDOVER
DCN: 21-08-0102-00-0sec
Title: Use Cases for MIH Services and MIH Protocol
Threats
Date Submitted: April 02, 2008
Presented at Security Study Group Teleconference on April 02, 2008
Authors or Source(s):
Shubhranshu Singh (Samsung) Marc Meylemans (Intel),
Subir Das (Telcordia Technologies)
Abstract: This document provides some deployment scenarios of MIH services and discusses the common security threats of MIH Protocol

IEEE 802.21 presentation release statements
This document has been prepared to assist the IEEE 802.21 Working
Group. It is offered as a basis for discussion and is not binding on the contributing individual(s) or organization(s). The material in this document is subject to change in form and content after further study.
The contributor(s) reserve(s) the right to add, amend or withdraw material contained herein.
The contributor grants a free, irrevocable license to the IEEE to incorporate material contained in this contribution, and any modifications thereof, in the creation of an IEEE Standards publication; to copyright in the IEEE ’ s name any IEEE Standards publication even though it may include portions of this contribution; and at the IEEE ’ s sole discretion to permit others to reproduce in whole or in part the resulting IEEE Standards publication.
The contributor also acknowledges and accepts that this contribution may be made public by IEEE 802.21.
The contributor is familiar with IEEE patent policy, as stated in Section 6 of the IEEE-SA Standards Board bylaws
< http://standards.ieee.org/guides/bylaws/sect6-7.html#6 > and in
Understanding Patent Issues During IEEE Standards Development http://standards.ieee.org/board/pat/faq.pdf
>

Scenario 1:
MN is in the home network and the MIH services (e.g.,
IS, ES, CS) are provided by the home network.
hPoS
Core Network
PoA
Home Network
Access
Network
Mobile Node
Note:
This and the following scenarios assumes PoA and PoS are separate entities however in some specific cases they might be co-located. We’ll address issues involved in such cases separately.

Scenario2:
MN is in the visited network and MIH services are provided by the home network hPoS
Home Network
PoA
Visited
Network
Mobile Node

Scenario3:
MN is in the visited network and MIH services are also provided by the visited network. There is a relationship between home and visited networks hPoS
Home Network vPoS PoA
Mobile Node
Visited
Network

Scenario4:
MN is in the visited or Home network and MIH services are provided by 3rd Party network.
PoS 3 rd Party
Network
PoA
Home or
Visited
Network
Mobile Node

• How to secure MIH Protocol message exchange?
• How to secure the access to MIH services?
• How to secure discovery of MIHF network entity?

• Some intermediate node may be capable of snooping, altering and forwarding the MIH packets
• IE in Information services could be altered in Request or
Response messages
• MIH events can be modified e.g., to change threshold values or even event ids and parameters
• Commands such as, Handover-candidate response or
Handover-commit from MN or network could be modified to affect handover (packets buffered/rerouted)
Having means for data protection (integrity and encryption) between source and target MIHFs at underlying layer can mitigate this security threat

• An ongoing session with one MIHF can be hijacked while providing the response or future packets from a different
MIHF node
• A certain event or command can be stored from one session and replayed later to the same node
Having means to verify the authenticity of the peer MIHF’s packet can mitigate this security threat

• Any node can provide an MIHF ID to gain access to the network MIHF entity
• Service Request or Response messages can be generated with any known/expired MIHF ID for which the service is not authorized or allowed
– MIH events can be send to change threshold values or other parameters
– MIH Commands such as, Handover-candidate response or
Handover-commit can be send to affect handover
Having means for data origin authentication from the source
MIHF can mitigate this security threat

• MIH events or commands can be originated by spoofing the MIHF ID
• Spoofing can be done as either a mobile node or a network entity that has the MIHF
• Any event or command can be triggered falsely to affect the network selection and handover
– e.g., Link-Going-Down, Link-Down and
Handover-commit
Having means to verify the authenticity of the MN
MIHF ID or network entity that has the MIHF can mitigate this security threat

• MIH access control is what MIH services the users can receive
• Operator may apply subscription profile to the user for customization (e.g, may be linked with MIHF ID)
– User can only use certain access technologies or can only query about certain access technologies
– Various roaming plans or information may be available depending on subscription profile
Having means for authenticating MIHF ID can mitigate this security threat

• This is a discovery issue
• IEEE 802.21 defines MIH Function discovery at layer 2 and
IETF defines at higher layers
– Discovery without proper security may lead to finding MIHF that may not be trustworthy
– L2 broadcast discovery is a good example, any entity can respond that it is MIH Function capable
• Our scope should be limited to L2 discovery
–
We can not work on something that we have not defined
Having means to protect information at lower layer can mitigate this security threat. If it uses management plane before association (e.g. 802.11) nothing much we can do

• In all scenarios:
•
•
Either Media Specific transport (e.g. L2) or
Media independent transport (e.g., L3 and above)
• Media Specific Transport (e.g., MN  PoA)
•
Security is provided by the link layers (except management plane, e.g., 802.11)
• Media Independent Transport (e.g., MN  PoA or PoA
 PoS)
• Use IPsec, TLS, DTLS

•
Update TR to reflect the agreed upon deployment scenarios
•
Perform threat analysis for the agreed upon deployment scenarios and capture them in the TR
•
In particular, capture the threats and assumptions specific to deployment scenarios
•
Based on the threat analysis, discuss/decide what is already available and what is specific to MIH Protocol