Fast, Secure Failover for IP Saleem N. Bhatti & Ditchaphong Phoomikiattisak Randall J. Atkinson School of Computer Science Cheltenham Research University of St Andrews USA St Andrews, UK Email: {saleem,dp32}@st-andrews.ac.uk Abstract—We describe a mechanism for fast, secure failover • Offers an end-to-end (site-to-site) solution: the necessary for IP. The mechanism is invisible to end-systems: sessions are system state is maintained between the trusted parties. maintained during failover. Our novel approach is to model • Can operate over existing IP networks and can be de- the failover as a mobility problem, and use a mobility solution in order to implement change in connectivity. Our system is ployed incrementally. based on the Identity Locator Network Protocol (ILNP), an • Offers graceful failover, with our testbed-based perfor- Experimental IRTF protocol which is realised as superset of IPv6. mance analyses showing virtually zero gratuitous loss Our empirical results from a testbed emulation show that there during failover. is almost zero gratuitous loss during failover. After presenting some related work (Section II), we provide an overview of the key features of ILNP (Section III). We I. INTRODUCTION then provide an analyses of the IPsec-compatible, graceful Uninterrupted communications for an individual host or an failover mechanism for ILNP describing its relevance to future entire site network are essential for mission critical operations. tactical networks (Section IV). This is followed by a perfor- Our focus in this paper is on network-layer interruptions that mance analyses of the solution, based on a testbed emulation could be due to faults or due to malicious intent. In such under different delay/loss conditions (Section V), and some cases, network-layer (i.e., IP) connectivity is perturbed,anda concluding remarks (Section VI). transition to alternative connectivity is required – failover.This II. RELATED WORK requirement is made more challenging by the requirement for such failover to comply with the existing security policy for In this paper, we treat network-layer (i.e., IP) failover as a the communication sessions that are in progress. Ideally, the mobility problem, because we see that changing the network- failover should also allow existing communication sessionsto layer connectivity is equivalent to network-layer mobility. So, experience minimal disruption – graceful failover. we review current mobility solutions as well as presenting an Specifically in this paper, we consider failover of commu- overview of ILNP. nication sessions where IPsec [1]–[3] is in use. IPsec forms A. Mobility mechanism as a failover mechanism the basis for the High Assurance Internet Protocol Encryptor (HAIPE) that is used to secure military communications using We propose a failover solution – graceful failover that is IP. IETF IPsec was not designed to provide automatic failover, based on a mobility model – soft handoff –thatcanberealised but proprietary solutions do exist. However, proprietary solu- with ILNP. We will show that this model is unique compared tions usually result in vendor lock-in and often can not be to other current mobility models (described below) in two key easily integrated with other important capabilities, such as aspects: (i) it is completely an end-to-end model, requiring mobility or multihoming. Router failover is possible by using only update of the end-systems that require the capability, the IETF Virtual Router Redundancy Protocol (VRRP) [4], and is completely compatible with use of end-to-end IPsec; but management of IPsec in this context is not well-defined. and (ii) it does not rely on the use of tunnels, proxies, or Additionally, reliance on clusters of routers with the VRRP other middleboxes, unlike other solutions. While the use of might lead to an operational landscape that is complex to tunnels does add some overhead, the use of middleboxes is configure, manage and maintain. potentially a risk for performance and security. A middlebox might become a single point of failure, or a performance A. Contribution bottleneck, and might offer alternative attack vectors for an adversary wishing to perturb the operation of the network. Our contribution in this paper is to present a network-layer We give a brief overview of the IETF-mandated mobility IPsec-compatible failover mechanism, using results from our mechanisms below, all of which, apart from SHIM6, rely on previous work on mobility [5], [6], which: either a middlebox, tunnelling, or both. • Does not require cooperation of the network provider, so Mobility extensions for IP, Mobile IP (MIP),havebeen the trust boundary is confined, with no dependencies on developed by the IETF for both IPv4 (MIPv4) [7] and IPv6 third parties. (MIPv6) [8]. Both require the use of a proxy – a Home Agent (HA) – and the use of tunnels from the Home Network of Overall, SHIM6 has a high signalling overhead. the mobile node to its current location. MIPv6 allows some B. Transport level mechanisms optimisation by the use of a Binding Update to bypass the Home Agent. However, its handoff model remains a hard Another possibility is failover at the transport layer. There handoff model, which typically incurs packet loss during has been work on the Stream Control Transport Protocol handoff, and so many extensions and modifications have been (STCP) [22] on enabling mobility, by dynamically changing proposed to MIPv6 in order to deal with this problem. addresses [23]. Modifications to TCP for enabling multi-path Mobile IPv6 Fast Handovers (FMIPv6) [9] uses tunnels TCP (MP-TCP) [24] have also been proposed for enabling between the Previous Access Router (PAR) and Next Access mobility [25]. In both cases, the fundamental mechanism Router (NAR) during handoff to reduce gratuitous packet loss proposed is based on multihoming the end-host with multiple during handoff [10]. When the packets are traversing the PAR- IP addresses (and multiple interfaces if required), and dropping NAR tunnel, routing is not optimal and the problems listed one of the addresses to achieve handoff/failover. above with use of tunnels and proxies are present. Enabling this in the transport layer has the advantages that Hierarchical Mobile IPv6 (HMIPv6) Mobility Management the transport protocol can apply congestion control across (HMIPv6) [11] is an extension of MIPv6 that uses an entity the failover, and the mechanism is end-to-end. However, called a Mobile Anchor Point (MAP) to reduce signalling the applications may need to be re-engineered for operation overhead, reduce handoff latency and so reduce gratuitous loss. over a new and specific transport protocol API, and some However, all traffic must go via the MAP. applications may not be easy to re-engineer. For example, real- An alternative to MIPv6 is Proxy Mobile IPv6 (PMIPv6) time communication uses UDP-based communication as TCP [12]. This has the disadvantages of requiring a proxy – a is unsuitable. Also, security concerns were flagged early on Mobile Access Gateway (MAG) –whichtracksmovements in the development process of both SCTP [26] and MP-TCP and registers them with another middlebox – a Local Mobility [27], some of which remain unresolved, with new attacks also Anchor (LMA) –whichisanalogoustoaHAinMIPv6.Also, being identified [28]. traffic between MAG and LMA is tunnelled. To minimise the C. Identifier-Locator Network Protocol handoff latency of PMIPv6, a Fast Handover mechanism is proposed [13], applying the concepts of FMIPv6 to PMIPv6. The Identifier-Locator Network Protocol ILNP is an exper- The Host Identity Protocol (HIP) supports mobility and imental protocol from the IRTF, and is described in RFCs multihoming [14], [15]. HIP uses public and private key pairs 6740-6748 [29]–[37]. While ILNP is a general architectural to give strong assurances of identity. The public key is used alternative to the current IP architecture [38], our previous as a Host Identifier by higher layer protocols (such as TCP) work on ILNP has demonstrated that it can support the fol- to represent the host identity, whilst an IP address is used lowing capabilities as first class functions; mobile hosts [39]; for routing. HIP requires use of strong cryptography and mobile networks [40], [41]; end-site control of multihoming support infrastructure, even in IP deployments where the threat and traffic engineering [42]; support for datacentres [37], [43] environment does not require strong cryptographic protection, including for network-layer virtual machine migration based e.g., inside a military network already secured using link-layer on the mobility model presented in this paper [43]. In ILNP, communications security (COMSEC) and possibly also trans- mobility and multihoming form a duality: the same basic mission security (TRANSSEC) mechanisms. For improved mechanism is used for both at the network layer, allowing performance, it is recommended that a HIP Rendezvous Server failover to naturally be modelled using a mobility mechanism (RVS - a middlebox) is used to coordinate communication. [44], [45]. We present salient details of ILNP in Section III. The Locator Identifier Separation Protocol (LISP) [16] III. ILNP is a network-based solution. LISP makes extensive use of The Identifier-Locator Network Protocol (ILNP)1 is a set tunnels and requires new network entities to be deployed of backwards-compatible and incrementally-deployable exten- and managed. LISP uses the ‘map-and-encap’ method for sions to IP [29]–[37] that have been recommended by the IRTF mapping IP addresses into a separate routing schema: Endpoint Routing Research Group (RRG) Chairs [46]. Identifiers (EIDs) and Routing Locators (RLOCs). LISP was originally designed for multihoming, but now has extensions A. Names and name bindings proposed to support mobile nodes (LISP-MN) [17]. ILNP changes the use of IP addresses in the protocol stack, The Level 3 Multihoming Shim Protocol for IPv6 (SHIM6) as shown in Table I. Also, instead of having static bindings [18] is a host-based solution that implements Locator-Identifier of IP addresses to interfaces, ILNP uses dynamic bindings separation.