Subject: RE: home network security

From: Austin Bill-P23393 <[email-masked]>
Date: Wed, 12 Apr 2000 10:31:12 -0700

> -----Original Message-----
> From: Paul Ferguson [mailto:[email-masked]]
> Sent: Sunday, April 09, 2000 8:12 PM
> To: Daniel Senie
> Cc: [email-masked]
> Subject: Re: home network security
> 
> 
> At 10:57 PM 04/09/2000 -0400, Daniel Senie wrote:
> 
> >Before we continue down this path of figuring out security 
> for accessing
> >these various devices in the house, can we figure out where the
> >addresses assigned to your water heater came from?
> 
> Ditto. I think a major reality check is needed here.
> 
> - paul
> 
> 

The recent announcement of the industry joint effort for secure mobile
electronic transactions (press release below) is somewhat encouraging to me.
A successful outcome of that effort will go a long way towards building a
common, open, systems approach to secure transactions and may be applicable
within the home network "trust" arena as well.

--
Bill Austin  
Motorola Bluetooth http://www.mot.com/bluetooth/
Bluetooth Mailing List  http://www.stockhelp.net/bluetooth/
Arizona High-Tech Talent Partnership  http://www.azhttp.net/

Ericsson, Motorola and Nokia Team to Develop a Common Framework for Mobile
E-business
STOCKHOLM, Sweden--(BUSINESS WIRE)--April 11, 2000-- 

The Industry Joint Effort aims at the Creation of the Personal Trusted
Device by Integrating Security and Transaction Applications into Mobile
Terminal Platform Ericsson, Motorola and Nokia today announced a joint
effort to develop an open and common industry framework for secure mobile
electronic transactions. 

The target of this initiative is to use existing and emerging standards to
build a common framework and to create an implementation roadmap in order to
enhance the fast adoption of trusted mobile e-business. Representatives from
the telecom, financial and the IS/IT industries will be invited to
contribute to the effort. 

The possibility to handle trusted electronic transactions from a personal
mobile device is regarded as one of the most important areas of the Mobile
Internet. The mobile device can be a tool for a variety of services, such as
banking and trading services, credit card and payment services,
loyalty/bonus services and ID-card services. The Ericsson, Motorola and
Nokia initiative defines an open platform for secure mobile phone
transactions. The aim is to offer solutions where security and payment
services will be integrated as a standard into hundreds of millions of
mobile devices in years to come. 

There are today several activities ongoing in order to facilitate secure
transactions from mobile devices. The initiative from Ericsson, Motorola and
Nokia will merge existing initiatives with the de facto standard for secure
mobile electronic transactions, including not only the technical
capabilities but also the context for how this concept shall be used and
executed. Some of the key technology cornerstones will be WAP security
functions, such as WTLS (Wireless Transport Layer Security) and WIM
(Wireless Identification Module) - as well as wireless Public Key
technologies (PKI) and already implemented mobile payment schemes. 

"For a user, a mobile phone is a highly personal device that today is
expected to be easily and securely tailored according to an individual need.
These expectations cover also the fast emerging mobile e-business sector. A
mobile device will be the platform to bridge the virtual and physical worlds
of e-business. Integrating security and transaction applications on a common
core standard and platform will create global mass market for mobile
e-business. This will benefit all participants from various industries
within the value chain, in addition to hundreds of millions of consumers
throughout the world," says Matti Alahuhta, President, Nokia Mobile Phones. 

"The ambition is to formulate an environment which allows mobile operators,
financial institutions and other service providers to facilitate secure
mobile transactions," says Jan Ahrenbring, Vice President Marketing and
Communications at Ericsson Mobile Communications. "Ericsson estimates that
by 2004 there will be around one billion users of mobile telephony and some
600 million mobile Internet subscribers worldwide. The most important thing
that is needed to get all these consumers to start using mobile e-commerce
is a standard, which makes it safe and easy to use," says Ahrenbring. 

"Motorola is committed to the development of the mobile Internet and making
it secure, not only via the Web-enabled phones that make access possible,
but also the technologies that enable this world without wires, said Rick
Darnaby, Senior Vice President & General Manager of Europe, Middle East &
Africa for Motorola's Personal Communications. "Trust is the key element for
mobile interaction and transaction. We envision mobile devices will soon
play a key role in virtually every aspect of our lives. We want to give
consumers the ability of stay securely connected, informed and to conduct
sensitive and financial transactions anytime and wherever they are." 

Creating a standard for secure mobile transactions also opens up the
possibility for small transactions to be handled via mobile devices, for
example ticketing applications. Mobile devices will also be used to handle
short distance payments and transactions enabled by the Bluetooth
technology, for example to point of sale machines and parking meters. The
initiative includes methods for service providers to expose their brand in
mobile devices. 

Nokia, Ericsson and Motorola are expected to issue technical and other
details about the context for secure mobile transactions by the end of May
on their web sites and invite others to participate in the work. The
ambition is to formulate an open framework before the summer, based upon
input from related industries. 

Nokia is paving the way to the mobile information society with its
innovative products and solutions. The company is a leading mobile phone
supplier and a leading supplier of mobile, and broadband IP networks,
related services as well as multimedia terminals. In 1999, Nokia's net sales
totaled EUR 19.8 billion (USD 19.9 billion). Headquartered in Finland, Nokia
is listed on the New York (NOK), Helsinki, Stockholm, London, Frankfurt and
Paris stock exchanges and employs more than 55,000 people. Visit the Nokia
website at http://www.nokia.com 

Ericsson is the leading provider in the new telecoms world, with
communications solutions that combine telecom and datacom technologies with
the freedom of mobility for the user. With more than 100,000 employees in
140 countries, Ericsson simplifies communications for its customers -
network operators, service providers, enterprises and consumers - the world
over. Please visit Ericsson's Press Room at:
http://www.ericsson.se/pressroom 

Motorola, Inc. (NYSE:MOT) is a global leader in providing integrated
communications solutions and embedded electronic solutions. Sales in 1999
were $33.1 billion. For more information about Motorola, visit the website
at http://www.motorola.com 

   CONTACT: Nokia Mobile Phones
             Tapio Hedman, + 358 10 505 5750
             or
             Nokia Mobile Phones, Communications, + 358 10 5051
             Ericsson Mobile Communications AB
             Jan Ahrenbring, +46 70 590 9900
             or
             Bo Albertson, + 46 8 764 1388 or +46 70 510 0992
             Motorola
             Natalie Link, +44 1256 790 707
             or
             Jennifer Weyrauch, +1 847 523 0015

---

From: Daniel Senie <[email-masked]>
Date: Wed, 12 Apr 2000 16:49:41 -0400

> within the home network "trust" arena as well.

That's all well and good, but rather off the topic of my mail, and
Paul's to which you responded.

Before we talk about how trust will work and where, we need to figure
out if it's even relevant to this working group. This is not the "home
networking" working group, it's "zero configuration."

The concern I raised is that we haven't talked about whether addresses
which are self-assigned through zeroconf are even publicly routable.
Previous work in this area argues for non-routable addresses. If that's
how we are going to proceed, there'll be NO communication between
zeroconf devices and the Internet at large, and thus the trust issue is
outside the scope of this working group.

Please let us do a reality check, as Paul suggested, and make sure we
stay in scope. If there's interest in topics outside this WG's charter,
then it may be time to consider additional working groups outside of
zeroconf for those discussions.

-- 
-----------------------------------------------------------------
Daniel Senie                                        [email-masked]
Amaranth Networks Inc.                    http://www.amaranth.com

---

From: Richard Johnson <[email-masked]>
Date: Wed, 12 Apr 2000 14:14:11 -0700 (PDT)

> outside the scope of this working group.

Seems to me there are three basic ways of getting an address:

1) from a DHCP server:
	This is not "zeroconf", but would be part of the transition
to a non-zeroconf network, etc.
	This address is *probably* routable to the Internet as a
whole, but may not be depending upon what address range the DHCP
server is handing out.  (Obviously, it could be handing out addresses
in the 10.0.0.0/8 net which would not be usable on the Internet
directly, however there could be a router somewhere doing NAT which
would make these systems "accessible" in a limited sorta way.)

2) via some type of zeroconf autoconfig using link-local addressing:
	This definitely would not be Internet accessible, ...  unless
there's a router somewhere playing tricks with NAT as in the case
above.

3) via some type of zeroconf autoconfig using the configured subnet
and mask for the network:
	This is assuming the zeroconf system can determine the correct 
subnet number and mask, and then do claim and defend on an address
randomly allocated on this network.
	This type of address would obviously be Internet accessible
and would not require NAT, ... unless...

It seems that case (3) could actually be case (1) if the "configured
network and mask" happens to be 10.0.0.0/8, and it seems that cases
(1) and (2) *could* be Internet accessible if there's a NAT box
involved somewhere.

This just goes to show you that whether or not an address is Internet
accessible is really up to the router which has been connected to the
network.  If that router has been configured to allow the address to
pass or traffic from outside to pass to the address (via NAT or
without it) to the Internet in some way, then it's Internet
accessible, otherwise not.  It seems that the issue of whether or not
an address is Internet accessible is not really a "zeroconf" problem,
per se.

It would be probably be good for us to make some recommendations as to 
what methods should be used in what order such that a system would has 
the highest likelyhood of getting an Internet accessible address,
however. 

/raj

---

From: "Bernard Aboba" <[email-masked]>
Date: Wed, 12 Apr 2000 23:01:29 -0700

>network.  

This is true except if we are talking about 169.254/16. In that case
it is NOT up to the router. The router MUST NOT let packets
sourced from this address off the link. This applies to multicast as
well as unicast. 

>It seems that the issue of whether or not

Yup. 

>such that a system would have the highest likelyhood of getting an 
>Internet accessible address, however. 

I think that there may be different goals for different classes of
hosts. For devices, this may not be a goal because auto-conf
(169.254/16) addresses may be fine. For other hosts it may be
a goal.

---

From: Daniel Senie <[email-masked]>
Date: Thu, 13 Apr 2000 08:52:02 -0400

> sourced from this address off the link. This applies to multicast as

Same is true of RFC 1918 addresses. Those also are specifically not to
be routed anywhere ever. They can be the private addresses used by a
NAT, of course.

> (169.254/16) addresses may be fine. For other hosts it may be

If devices don't need to be moved off of 169.254/16, then they also
don't need to be accessed from outside, unless via an
application-specific gateway, and thus the security question becomes an
application gateway issue.

You're talking about the zeroconf mode using 169.254/16. If that's the
case, then zeroconf mode == private network only.

---

From: Gabriel Montenegro <[email-masked]>
Date: Thu, 13 Apr 2000 09:12:16 -0700 (PDT)

> be routed anywhere ever. 

where is this specified? 

"not to be routed" is perhaps too strong?
did you really mean that rfc1918 addrs are link-local?
or just that they are not to be forwarded/routed out of a
given 'site'.

-gabriel

---

From: Daniel Senie <[email-masked]>
Date: Thu, 13 Apr 2000 12:35:11 -0400

I'll go reread RFC 1918, but I do indeed believe it says these addresses
are not to appear on the public network. Well, the language is a little
weaker than I thought:

   It is strongly recommended that routers which connect enterprises to
   external networks are set up with appropriate packet and routing
   filters at both ends of the link in order to prevent packet and
   routing information leakage. An enterprise should also filter any
   private networks from inbound routing information in order to protect
   itself from ambiguous routing situations which can occur if routes to
   the private address space point outside the enterprise.

That's from the operational considerations section.

You can certainly route RFC 1918 addresses within a private network but
they should be filtered at all times (packet and route) from the public
network. This is what I meant when I said RFC 1918 addresses shouldn't
be routed. In private networks you can indeed route them...

---

From: "Bernard Aboba" <[email-masked]>
Date: Thu, 13 Apr 2000 18:27:40 -0700

>are not to appear on the public network. 

This is not the same thing as linklocal. RFC 1918 addresses can be
translated so that they don't appear on the public network. However,
my understanding is that linklocal addresses (169.254/16) are not
to leave the link, even if they are translated. So the only avenue
for connectivity of linklocal devices is application layer 
gateways (ALGs).