移動(dòng)檢測(cè)HomeAgentRemoteNodeMobileNodeForeignAgentMIPv4：使用外地代理轉(zhuǎn)交地址

MobileNode①代理公告移動(dòng)檢測(cè)使用外地代理轉(zhuǎn)交地址MotivationforHIP

家鄉(xiāng)代理通信對(duì)端外地代理綁定注冊(cè)家鄉(xiāng)代理通信對(duì)端移動(dòng)節(jié)點(diǎn)外地代理②注冊(cè)請(qǐng)求②注冊(cè)請(qǐng)求③注冊(cè)應(yīng)答③注冊(cè)應(yīng)答MotivationforHIP

接收/發(fā)送分組家鄉(xiāng)代理通信對(duì)端移動(dòng)節(jié)點(diǎn)外地代理代理ARP和免費(fèi)ARP隧道IP數(shù)據(jù)IP頭標(biāo)IP數(shù)據(jù)IP頭標(biāo)IP頭標(biāo)家鄉(xiāng)代理處IP-in-IP封裝外地代理處IP-in-IP解封裝源：家鄉(xiāng)代理地址目的：外地代理地址分組分組分組分組MotivationforHIP

家鄉(xiāng)代理通信對(duì)端移動(dòng)節(jié)點(diǎn)外地代理三角路由問(wèn)題三角路由問(wèn)題MotivationforHIP

MotivationforHIP攻擊者能夠監(jiān)聽(tīng)到移動(dòng)節(jié)點(diǎn)的數(shù)據(jù)包攻擊者在家鄉(xiāng)網(wǎng)絡(luò)和通信對(duì)端的路徑上獲得綁定管理密鑰，偽造綁定更新等SecurityproblemWhatisHIPNewcryptographicidentifiersHostIdentities(Publickeyofakeypair)HostIdentityTags(128bits)IPaddressesaslocatorsAnauthenticationandkeyexchangeprotocolIPsecESPtransportmodefordatatrafficsecurity.HIP:HostIdentifyProtocol(RFC4423)WhatisHIPHIPLayeringModel:WhatisHIPHIPheader:WhatisHIPThedoublelookupmechanism

:HIPbaseexchangeDataheadercompressionHIPbaseexchangeHIPUPDATEProcedure

:WhatisHIPHIPandMiddleboxesAsymmetricpathsInterception,aspreviouslydescribed,isnotpossible:Firewall(I)needstoknowSPI(I)Firewall(R)needstoknowSPI(R)ProblemwithRoutingAsymmetryHIPregisterextensionHIPregisterextensionSystemframework發(fā)起端中間系統(tǒng)R1’I2’R2’I1響應(yīng)端I1中間系統(tǒng)FW-IR1R1’I2’R2’R1R1I2I2R2R2I1FW-RSPI(I),SPI(R)SPI(I),SPI(R)HIPCookies預(yù)先產(chǎn)生隨機(jī)數(shù)I;謎題的難度系數(shù)K是可調(diào)整的;難題解答與驗(yàn)證的難度不對(duì)稱(chēng);Diffie-Hellman密鑰交換機(jī)制ConsiderationofsecurityYlitalo,J.,Melen,J.,Nikander,P.andV.Torvinen,"Re-thinkingSecurityinIPbasedMicro-Mobility",7thInformationSecurityConference(ISC-04),PaloAlto,",September2004.Moskowitz,R.,Nikander,P.,Jokela,P.andT.Henderson:"HostIdentityProtocol",draft-ietf-hip-base-00.txt(workinprogress),June2004AbobaB.andDixonW.,IPsec-NetworkAddressTranslation(NAT)CompatibilityRequirementsRFC3715,March2004.H.Tschofenig.,"draft-tschofenig-hiprg-hip-natfw-traversal-06.txt",(workinprogress),July9,2007A.Huttunenetal,A.,"UDPEncapsulationofIPsecPackets",draft-ietf-ipsec-udp-encaps-07.txt(workinprogress),Jan2003.J.Laganier.,"draft-ietf-hip-registration-02.txt",(workinprogress),June7,2006.H.Tschofenig,A.Nagarajan,Siemens,etal.NATandFirewallTraversalforHIP

draft-t