Security - Telenor

Henning Wright Hansen (28) is
Research Scientist at Telenor
R&D, Kjeller, where he has been
working on aspects related to
Internet security since 1996. His
research interests include wide
aspects of security related to
computing, focusing on the
security consequences of introducing
Internet mobility as well
as solutions making the Internet
a safer place to be for the mobile
users of the future. He is also
involved in the TigerTeam activities
(practical security testing)
at Telenor R&D.
henning-wright.hansen
@telenor.com
Dole Tandberg (38) is Research
Scientist in the Security Group at
Telenor R&D, Kjeller, where he
has been working since 1997.
His research interests include
security in Internet and mobile
distributed systems. He is also
involved in the TigerTeam activities
and practical security
exploits.
Background: 1982–1988 University
of Zagreb, Croatia; 1988–
1996 ABB Corporate Research;
4 patents holder (2 WW and 2
UK); 1994 Sheffield University
(UK), Largest civilian FEM-test
research program; 1995 London
Conference “New Era Technology”
paper holder.
dole-stojakovic.tandberg
@telenor.com
26
Security in a Future Mobile Internet
HENNING WRIGHT HANSEN AND DOLE TANDBERG
Introduction
Everyone knows it – computers are getting more
and more common. Computers are also getting
more and more portable. At the same time the
Internet has become a common place. The professional
computer users demand the possibility
to work as usual independent of time and place.
And why not? The technology that will make
this happen is more or less here.
However, the companies that own and control
the computers used by these demanding users
have second thoughts. What about security? The
Internet is itself a “dangerous” place to be, and
even highly skilled personnel make mistakes
when implementing security solutions to protect
the internal network from script kiddies or maybe
even worse, from unscrupulous competitive
companies or foreign governments. Who really
knows what might be out there?
And now the users want to open up the internal
network to be accessed from the Internet. How
could this be done in a satisfyingly secure manner?
How should the mobility management be
implemented to allow for transparent access –
both to and from the machines on the road?
This article will try to cover these issues and
propose solutions that may become the future
foundation for secure Internet mobility in the
years to come, with a particular focus on the
users and their terminals. Only selected security
technologies will be covered, focusing on the
mobile users and their terminals.
A Mobile Wireless Network
of the Future
The Internet has traditionally offered very poor
support for mobility. It is of course possible to
move computers connected to the Internet from
one local area network to another, but there has
been no support for mobility. That is; when
moving a computer from one LAN to another,
you have to supply it with a brand new IP address.
From the network point of view, this is
seen as a totally different computer since the IP
address is used to identify it. Even today, some
legacy operating systems claimed to be “up to
date” need to be rebooted in order to use a different
IP address.
Mobile IP is about to change this, however,
allowing the computer to be moved to keep its
old IP address used for identification, and at the
same time obtain and use a new topologically
correct IP address. This may be achieved by
using e.g. tunneling mechanisms.
Internet mobility may be achieved without altering
the routers or other hosts on the Internet, the
only thing really needed is a Home Agent placed
on the home network. The Home Agent is
responsible for registering the current locations
(IP addresses) of mobile nodes, and forwarding
packets destined for the mobile node out to its
current location. Authentication is built-in in
order to make it difficult to redirect traffic to
unauthorised hosts, this will help prevent someone
stealing traffic destined to the mobile nodes.
When a mobile node connects back to the home
network, an extension is made from the LAN to
the Mobile Node. Traffic traditionally being
internal and restricted to the LAN only, now
ends up being routed over the Internet for everyone
to see. Utilising VPN technology is therefore
very important if privacy, authenticity and
integrity of the data exchanged is of any concern.
Traditionally VPN systems have been used
for protecting traffic between different kinds of
networks, but the same technology may be integrated
directly on the mobile nodes in a network-to-host
scenario. (Or host-to-host for that
matter.) The technology used to achieve this is
typically IPsec.
At the home network, the extension of the home
network towards the mobile nodes is typically
combined with the use of firewalls. The firewall
is supposed to enforce a security policy separating
those “inside” from those “outside” the firewall.
Wireless technology such as the IEEE 802.11
may be used as one attractive method of accessing
the Internet or LAN IP networks. The security
mechanisms in these standards are however
limited in flexibility, and VPN technology is
therefore needed on top. WLAN technology is
sometimes envisioned to replace traditional
wired LAN networks, particularly in dynamic
and new environments. Time and money may be
saved as the need for cabling is reduced considerably.
In future office environments, WLAN
technology may be used as a shared access technology,
e.g. within a large office building. It
would be much more efficient to offer WLAN
access to all employees in different firms within
the building, instead of having each firm imple-
Telektronikk 3.2000