On the enhancement of mobility and multimedia communications in heterogeneous RANs

22 Int. J. Internet Protocol Technology, Vol. 3, No. 1, 2008

Copyright © 2008 Inderscience Enterprises Ltd.

On the enhancement of mobility and multimedia communications in heterogeneous RANs

Michael Georgiades and Klaus Moessner Centre for Communication Systems Research, University of Surrey, Guildford, Surrey GU2 7XH, England E-mail: [email protected] E-mail: [email protected]

Tasos Dagiuklas* Department of Telecommunications Systems and Networks, TEI of Mesolonghi, 30300 Nafpaktos, Greece E-mail: [email protected] *Corresponding author

Abstract: Ambient Networks (AN) aim to embrace the heterogeneity arising from different network technologies such that it appears homogeneous to the potential users at the level of network service provisioning. This paper focuses on the employment of a State Transfer Module (STM) in AN for enhancing mobility and minimising the impact of multimedia service discrepancy (e.g., security, session continuity) by supporting the transfer of authentication and authorisation states upon handoff as well as supporting multimedia session continuation while the users roam and handoff across heterogeneous wireless networks.

Keywords: Ambient Networks; mobility management; STM; AAA; middleboxes; multimedia service continuity.

Reference to this paper should be made as follows: Georgiades, M., Moessner, K. and Dagiuklas, T. (2008) ‘On the enhancement of mobility and multimedia communications in heterogeneous RANs’, Int. J. Internet Protocol Technology, Vol. 3, No. 1, pp.22–34.

Biographical notes: Michael Georgiades is a research fellow in the Mobile Communications Research Group, at the Centre of Communication Systems Research (CCSR) at the University of Surrey. He received a BEng in Communications and Radio Engineering from King’s College London in 2000, an MSc in Telecommunications at University College London in 2001 and a PhD from University of Surrey in 2008. He has been involved in several IST EU projects related to next generation networks and has published more than 20 papers at international journals and conferences in the field. He is a member of IET and IEEE.

Klaus Moessner is a senior research fellow in the Mobile Communications Research Group, at the Centre of Communication Systems Research (CCSR) at the University of Surrey. He earned his Dipl-Ing (FH) at The University of Applied Science in Offenburg, Germany, an MSc from Brunel University, UK and his PhD from the University of Surrey (UK). He leads a research team on Software based systems and IP based internetworking technologies in CCSR. His research into wireless communication systems has brought forward three patents as well as several refereed publications in international journals and at conferences.

Tasos Dagiuklas is an Assistant Professor at the Department of Telecommunications and Network Systems, Technological Educational Institute (TEI) of Mesolonghi, Greece. He received the Engineering Degree from the University of Patras-Greece in 1989, the MSc from the University of Manchester, UK in 1991 and the PhD from the University of Essex, UK in 1995, all in Electrical Engineering. He has been involved in several EC R&D Projects in the fields of converged networks and services. He has published more than 60 papers at international journals and conferences in the above fields. He is a member of IEEE and Technical Chamber of Greece.

On the enhancement of mobility and multimedia communications in heterogeneous RANs 23

1 Introduction

As the demand for multimedia and mobility services increases the tremendous growth in data traffic has forced the wireless industry to evolve towards all-IP networking (Tafazolli, 2005; Berezdivin et al., 2002; Sestini et al., 2003). With the deployment of 3G systems emerging, it is necessary to consider how beyond 3G network architectures will evolve in order to embrace a much wider range of users, applications and economic deployment. There is no industry consensus on what ‘Systems beyond 3G’, will look like but as far as the next generation networks is concerned, concepts and ideas include: Transition towards an “All-IP based” network infrastructure; Support of heterogeneous wireless technologies (i.e., UTRAN, Ad-hoc, WLANs); seamless handover across both homogeneous and heterogeneous wireless access technologies; QoS support at the IP layer; Multilayer Mobility Management suitable to support fast mobile users that may access a wide range number of services with diverse characteristics; Network access control of mobile users (i.e., deployment of AAA protocols that allow inter-domain network access control) regardless of heterogeneous wireless access network used; Distributed AAA architecture for the dynamic establishment of trust relations in hybrid IPv4/IPv6 networks; Secure access to multimedia services across different networking environments; Use of policy-based mechanisms in order to determine QoS, accounting, and billing mechanisms for multimedia services; Access to multimedia services in hybrid IPv4/IPv6 based networks.

Ambient Networks (AN) aim to support this vision by embracing the heterogeneity arising from the different network control technologies such that they appear homogeneous to the potential users of network services (Niebert et al., 2004). One of the biggest challenges is to support the provisioning of seamless and secure mobility in such a heterogeneous environment. Until now, mobility management solutions dealt mainly with user terminal handovers between two wireless Access Points (APs) in an operator-controlled infrastructure; these handovers were predominantly initiated by physical relocation. However, in the emerging network scenarios considered within AN, the term ‘mobility’ has a wider sense and involves system responses to any changes in the user and network environments, including changes in radio and network/application resources as well as commercial conditions. Furthermore, mobility solutions need to support a larger variety of mobile entities. Accordingly, it is no longer possible to envisage a single mobility paradigm that can address this diverse set of requirements. Instead, we introduce the concept of a set of solutions that can be flexibly combined and integrated on demand.

Within the context of this paper, a State Transfer Module (STM) is proposed within the AN architecture in order to support mobility management and retain multimedia session continuity upon handoff. The idea of state transfer was introduced in Kempf (2002) and Loughney et al. (2005) as a solution to minimise the impact of certain transport/routing/security-related services on the

handover performance. When a Mobile Node (MN) moves to a new subnet it needs to maintain such services that have already been established at the previous Radio Access Network (RAN). In Kempf (2002) such services were referred to as “context transfer candidate services”, and examples of these services include AAA profile, IPsec state, header compression, QoS policy, multicast membership number, and session maintenance etc. (Politis et al., 2007; Leggio et al., 2005). Re-establishing these services at the new subnet will require a considerable amount of time for the protocol exchanges and as a result time-sensitive real-time traffic will suffer during this time. Alternatively, context transfer candidate services state information can be transferred, for example, from the previous RAN to the new RAN so that the services can be quickly re-established.

As opposed to Loughney et al. (2005) the state transfer solution proposed in this work utilises the AN concept, modular approach and framework by providing a standalone STM in a well defined Ambient Control Space (ACS). The advantages of doing this include but are not limited to: synchronisation with a plurality of mobility management protocols; utilisation of triggers and signalling received by a common handover selection tool with the mobility management protocols, the possibility to trigger state transfer not only from the mobile terminal, use of well defined AN signalling and transport layer protocol for such a peer-to-peer communication, utilisation of the modular approach and well defined interfaces.

The paper is organised as follows: Section 2 presents the STM in AN, Section 3 gives a performance evaluation of the use of STM for AAA State Transfer support, Section 4 describes the use of STM to support middlebox devices in a RAN for multimedia session continuation and for minimising security risks within RANs. Section 5 presents the conclusions and outlook of this work.

2 State transfer in Ambient Networks

2.1 Ambient Networks architecture

The AN architecture is described in Niebert et al. (2004) and aims to support existing network services of heterogeneous networks. A core requirement in ANs is the ability for networks to compose – that is support mechanisms that achieve on-the-fly negotiations and agreements across different administrative domains; and provide the ability to reconfigure in a self managed way. There are three main components of the architecture, as shown in Figure 1.

• The ACS consists of cooperating control functions. It is designed such that, although initially a small number of control functions are specified, additional functions can easily be added or removed.

• The Ambient Connectivity abstraction layer provides the ACS with a generic, technology independent view of the underlying connectivity.

• The Ambient Network Interfaces (ANI):

24 M. Georgiades et al.

• the ANI connects the components of the ACS belonging to different AN; composition takes place across this interface.

• the interface between the ACS and the connectivity is the Ambient Resource Interface (ARI); providing a homogeneous way to deal with radio access technologies and internetworking procedures.

• The Ambient Service Interface (ASI) provides the interface to the applications and services, so that they can use the functionality provided by the ACS.

The ACS is the environment within which a set of modular control functions can co-exist and cooperate. The environment includes plug and play concepts that allow the ACS to bootstrap and discover the set of present functions dynamically. Further, a naming structure and registration mechanisms are defined to ensure that new functionality can be developed and integrated without impacting the overall system design and implementation. More information on the AN Architecture can be found in Niebert et al. (2007).

Figure 1 Ambient Network Architecture

2.2 The State Transfer Module

By embracing the AN architecture described above we propose a STM as part of the ACS. The modular concept of the AN architecture provides an ideal placeholder for a standalone STM. STM has been designed as a plug-in module configurable to cooperate with a plurality of different mobility management protocols and utilise handover triggers and events (Surtees et al., 2007). The main advantage of this is that only the access routers are involved in the context transfer exchange and the mobile host remains unaware of the context transfer is taking place. Furthermore in AN we consider state transfer as module to be used in a plug-n-play fashion in a well defined architecture as opposed to a protocol which is bound by the entities involved Loughney et al. (2005) considers mobility management solutions which dealt mainly with user terminal handovers between two wireless APs in an operator-controlled infrastructure). AN involves system responses to any changes in the network environments as well as the user, including changes in radio and network/application resources as well as commercial

conditions. The use of composition in AN can also resolve the issue of identifying whether a corresponding router supports state transfer or not currently not considered in Loughney et al. (2005). The idea of subscribing to handover triggering events in AN is to avoid the need to synchronise with the mobility management protocol used as both STM can subscribe to the same triggering events consumed by the mobility management protocols. Moreover STM can be benefited from the well defined AN signalling and transport layer protocol and well defined interfaces for such a peer-to-peer communication in a heterogeneous network environment.

STM can be used to forward any endpoint associated on-path states during the handover operation. Its aim is to contribute to the seamless operation of the handover process of mobile users by minimising the re-establishment of associated states at the new point of attachment. Examples of states may include:

• Application state, for example when applications or individual bearers are moved, the conditions such as device properties may change. Forwarding these states will allow the application to let it pick up where it left off.

• Flow-related state, such as header compression, QoS profiles, or any information associated with the flow identifier, identity translation state to support the routing of packets through the underlying connectivity. It should also include the NID IR states.

• User-related state, for example, AAA state, user associated on-path middlebox policies.

This paper investigates two different scenarios for STM:

• How state transfer could support AAA during mobility thus minimising their impact on the handoff performance.

• How state transfer could support middleboxes in order to minimise their impact on the re-establishment of multimedia sessions of a mobile user as well as update port status in middleboxes in order to maintain multimedia session without any disruption.

The performance for these scenarios has been evaluated both analytically as well as through simulation using a prototype testbed implementation.

3 AAA state transfer

3.1 Problem description

AAA is a framework for controlling the access to computer resources, enforcing policies, inspecting usage, and providing the information required to bill for services. The introduction of AAA functionalities adds an undesired delay component while the user requests network access upon handing off. The time consumed by AAA transactions may affect the handoff latency and consequently affect the ongoing sessions (Georgiades et al., 2004). During the


handoff, the interactions between MN and AAA servers must be avoided or at the very least, reduced. The next section illustrates how state transfer could enhance AAA functionality during mobility thus minimising their impact on the handoff performance. The performance of the proposed AAA state transfer solution is then evaluated both analytically as well as using a prototype testbed implementation.

3.2 Solution description

In a heterogeneous wireless networking environment, the primary challenge regards the adoption of an independent AAA access scheme, allowing the network to authenticate the users regardless of the technology used. Without loss of generality, a RADIUS-based AAA server has been studied due to its simplicity to be deployed in small number of networks/domains as well as its stable open source availability. The same methodology could also be applied to DIAMETER, the emerging standard for wireless domains.

Within the context of this research work, RFC 2865 describing the RADIUS protocol (Rigney et al., 1997), has been used. It is a protocol for carrying AAA information between a Network Access Server and a shared Authentication Server. As an example, in a WLAN access network, the wireless AP acts as the NAS while a RADIUS server may act as an Authentication Server. The IEEE802.1x standard has been proposed for port-based network access control for WLANs.

The message exchange between the MN and the NAS takes place using the Extensible Authentication Protocol (EAP) (Blunk and Vollbrecht, 1998).

EAP allows arbitrary authentication methods using credential and information exchanges of arbitrary lengths. By using EAP, support for a number of specific authentication schemes known as EAP types may be added, including token cards, one-time passwords, and public key authentication using smart cards, certificates, and others. Strong EAP types such as those based on certificates offer better security against brute-force or dictionary attacks and password guessing than password-based authentication protocols. An AP that supports EAP is not required to have an understanding of the specific EAP type used in the EAP authentication process. It is aware only of when the EAP authentication process starts and ends. The EAP-TLS method has been considered for our experiments. EAP-TLS is a mutual authentication method, which means that both the client and the server prove their identities to each other (Simon et al., 2008). During the EAP-TLS exchange, the supplicant sends its user certificate and the RADIUS server sends its computer certificate. If either certificate is not sent or is invalid, the connection is terminated. During the EAP-TLS authentication process, shared secret encryption keys are generated.

Figure 2 shows a signalling flow diagram of the EAP-TLS message exchanges between the MN, the new

base station and the RADIUS server, upon handoff takes place. As shown in this signalling exchange, once the MN handoffs to the new domain, multiple message exchanges are required between these entities prior to the network authenticates the MN. This delay could be very large especially if the RADIUS server resides several hops far away from the new base station. Hence, it would be desirable to avoid this message flow exchange and accelerate the re-authentication of the MN.

Figure 2 and 3 compare the resulting AAA message flow when not using and applying AAA Context Transfer respectively. There are two possible scenarios regarding AAA State Transfer:

• Reactive State Transfer (See in Figure 2). In this case, upon handoff the MN sends a CXT-Trigger message towards the new RAN. Upon the reception of the CXT-Trigger packet, the nAP of the new RAN sends a CXT-Request message to the pAP of the old RAN, which in turn forwards the requested AAA context in the CXT-Reply packet. The new RANstores the context in its cache and forwards the context to the new base station (nAP) in a CXT-Update packet. The nAP installs the context and then re-authenticates the client on the basis of the received information. This clearly demonstrates how the number of messages exchanged is reduced, thus avoiding communication with the RADIUS server but at the same time the client is authenticated by the network on the basis of the received context information.

• Predictive State Transfer (See in Figure 2). It is similar to the reactive case but the procedure up until the installation of the context at the nAP takes place prior handover occurs.

Figure 2 EAP-TLS signalling


Figure 3 AAA state transfer solutions

3.3 Performance evaluation

In this section, we describe the analytical model used to evaluate the performance of AAA state transfer. Particular emphasis has been given in the additional delay component faced by the MN during the handoff operation introduced by the context transfer protocol procedure as compared to the ordinary AAA procedure. Furthermore to obtain a quantitative measure of the performance we calculate the packet loss during this period for different scenarios. We consider that state transfer packets are not fragmented and are of fixed length (a practical assumption in current networks). In Table 1, we define the parameters that will be used for our analysis.

Table 1 AAA parameters for quantitative analysis

Parameter Meaning λα–β Transmission rate from α to βεα Processing delay + Routing table lookup at αδα Latency across link α = Propagation delay

+ Link Layer delay δα–β One way delay between α and βδ(scheme) Total time required by the protocol to complete

it’s procedure σ(scheme) Total number of packets lost during the protocol’s

procedure

According to Figure 2, the time required for the EAP-TLS signaling exchanges to be carried out can be regarded as the time from when the LCP Request-EAP auth message is sent by the nAP until the elapsed time required by the MN to receive the EAP success message. The end-to-end delay from α and β can be defined as the total sum of the delays across each link as well as the processing delay at each entity in between:

1 1

n m

ji j

α β ιδ δ ε−= =

= +ä ä

where n is the total number of links between α and β and mis the total number of entities when a packet is processed. We can also determine the total time taken from the signalling exchanges of a scheme to be:

(scheme)1 1

n m

i j ji j

x yιδ δ ε= =

= +ä ä

where xi is the number of times a packet traverses link i and yj the number of times a packet traverses, is processed by entity j.

Figure 4 shows the model which was used for quantitative analysis. In this diagram, a MN hands-off from the previous AP (pAP) to the new one (nAP) and requires re-authentication. In order to determine the total overhead, a certain number of delay components has been defined for the main entities involved in the above scenario. We are mainly interested in

• the delay that a packet experiences across the wireless link

• the delay between the APs (nAP or pAP) and the Mobility Gateway (GW)

• the delay between the GW and the AAA server which we assume equivalent to the internet delay.

Figure 4 AAA model for qualitative analysis (see online version for colours)

Without loss of generality, we also assume that the processing delay at each entity is small enough to be ignored. Table 2 shows the different values for our analysis. For the typical values of the parameters used in this analysis, please refer to Kong et al. (2006), Lai and Chiu (2005) and Lo et al. (2004).


Table 2 Typical values for AAA modelling evaluation

Parameter Meaning Value range Experimentalvalue

δw One way delay across wireless link

10–50 ms Variable

δnar–gw One way delay between new access router (nar) and Mobility Gateway (gw)

10 ms 10 ms

δpar–gw One way delay between previous access router (par) and Mobility Gateway (gw)

10 ms 10 ms

δpar–gw One way delay between previous access router (par) and gateway (gw)

10 ms 10 ms

δgw–aaa One way delay between gateway (gw) and AAA Server (aaa) ~ Internet Delay

30–100 ms 50 ms

εα Processingdelay + Routing table lookup at α

0.001 ms Ignore

λCN–MN Transmission rate from CN to MN

100–1000packets per second

Variable

From the model shown in Figure 4 and the signalling flow illustrated in Figures 2–3, we can determine that the total time required for the AAA procedure as:

(AAA) aaa nar aaa6 3 4 11 8( ).mn ar w gw gwδ ε ε ε δ δ δ− −= + + + + +

Similarly to the above scenario, the time required for the STM signalling exchanges to be carried out can be regarded as the time from when the CXT Trigger is sent from the MN to the nAP to the time the MN receives the EAP success message from the nAP (see Figure 2). From Figure 4, we can therefore say that the time required by the CT scheme signalling exchanges is:

(STM) par2( ) 3 .mn w gw arδ ε δ δ ε−= + + +

Using now the time required by the two schemes δ(AAA) and δ(STM) and the rate at which the MN is receiving packets from the CN (λCN–MN) we can determine the number of packets lost.

(AAA) (AAA) ( ) (STM)and .CN MN CT CN MNσ λ δ σ λ δ− −= × = ×

Figure 5 shows the total handoff delay taken by the two protocols (δ(AAA) and δ(STM)), for different values of the wireless link delay. Figure 6 shows the additional packet lost per handoff for each scheme σ(AAA) and σ(STM) for different transmission rate values (λCN–MN).

Figure 5 Additionally handoff delay experienced at MN due to AAA and STM procedure (see online versionfor colours)

Figure 6 Packet loss experienced at MN during the AAA and STM procedure (see online version for colours)

Figure 5 illustrates that for the selected values used for the wireless link delay (δw) STM performs 8–9 times better. As expected the higher δw the higher the improvement gain of STM as compared to AAA, since STM has minimum signalling across the wireless link. Similarly Figure 6 illustrates how STM can minimise the number of packets lost for different number of bit rates.

3.3.2 TestBed evaluation

The Wireless Network Testbed (WNT) of the Center for Communication Research at the University of Surrey provides a flexible, re-configurable wireless network platform, capable of supporting an extensive range of networking and service provisioning scenarios (http://ee.surrey.ac.uk/CCSR/Mobile/Projects/Testbed). The testbed itself contains almost all the essential constituents of the Mobile Wireless Internet. Wireless connectivity can be provided by a set of Cisco Aironet wireless APs. Some laptops have also been configured to work in Host AP mode where the Host AP driver takes care of IEEE 802.11 management functions and enables the node computers to act as APs. Furthermore, they provide authentication


support based on the IEEE 802.1x port-based standard, using the EAP (Simon et al., 2008).

A RADIUS server is used for the actual authentication. Toshiba laptops (running Windows and Linux) and Compaq iPacs are used as wireless clients. The clients are equipped with camera and audio-video devices and have several multimedia applications installed. They can also be configured to run in the ad hoc networking mode.

For handling mobility we used the open source Dynamics Mobile IP implementation (http//www.cs.hut.fi/ Researchs/Dynamics). The available Cisco routers also support Mobile IP which can interwork with the Dynamics Mobile IP client software. Both gateways are equipped with an implementation of the context transfer protocol for transferring state information from one to the other if desired during handoff. The two Linux PCs which are configured to act as MGs also have a firewall co-located. Figure 7 illustrates the testbed setup which was used to investigate the performance of both scenarios.

Figure 7 AAA state transfer scenario in WLAN environment(see online version for colours)

For the UDP traffic, a SIP client was used that can set up voice calls between two end hosts over an IP network. A phone session is set up between a MN and a Corresponding Node (CN). While the session is ongoing, the MN handoffs to a new base station and the session is disrupted. To re-establish the session, the application must send a new session set up request (re-establishment) to the CN.

Figure 8 shows the time delay it took for the MN to re-establish the SIP session, assuming that UDP payload is employed to convey SIP signalling. The x-axis of Figure 8 enumerates the handoff attempt while the y-axis shows the handoff delay experienced by the application during each handoff attempt. These results clearly indicate the improvement when STM is enabled. It can be seen from the graph that the handoff delay with STM disabled was about 7.9 s on average, with a maximum 8.3 s and a minimum of 7.4 s. On the contrary when STM was enabled, the handoff delay was significantly reduced to about 3.4 s ranging from 2.9–4 s.

For the TCP traffic, the MN starts communication with an FTP server and begins to download a large file (7 Mb).

While it downloads, it handoffs to another base station and the authentication procedure is repeated again before it can resume the FTP session. Based on the time arrival of TCP traffic the handoff delay was recorded. Figure 8 illustrates the handoff delay experienced by the application for ten different handoff attempts. It can be seen from this figure that the handoff delay with STM disabled was about 6.3 s on average with a maximum of 6.7 and a minimum of 5.9. On the contrary when STM was enabled the handoff delay ranged from 0.9 s to 1.3 s with an average of 1.1 s.

Figure 8 The impact of STM on SIP/UDP multimedia application upon MN’s handoff in WLAN

4 Multimedia session maintenance among heterogeneous RANs using state transfer

A MN may handoff among heterogeneous RANs which may be either protected by separate middleboxes such as Firewalls/NATs (Politis et al., 2007) or deployed using private addresses behind NATs (Salsano et al., 2007). As any ongoing sessions in the old RAN may be interfered with by the midllebox in the new RAN.

A middlebox is defined as any intermediary device performing functions other than the normal, standard functions of an IP router on the datagram path between a source node and destination node (Carpenter, 2002). Middleboxes enforce application specific policy-based functions such as packet filtering (firewall operation), Network Address Translation (NAT), Virtual Private Network (VPN) tunnelling, Intrusion detection, Load balancing (to balance load across servers, or even to split applications across servers by IP routing based on the destination port number) etc.

When the MN leaves the previous network, any open ports used for this MN’s sessions will only close upon timeout leaving the firewall susceptible to numerous attacks (Frantzen et al., 2001; Schultz, 1997). As shown in Figure 9, a MN may be connected to WLAN1 and communicate with a CN using a certain application.


Figure 9 Loss of a session for a MN who hands off between different RANs (see online version for colours)

While FW1 allows the MN’s session to traverse when the MN’s handoffs to WLAN2, even if authorised to access the network, FW2 may block any of the users’ ongoing sessions. Furthermore the delay introduced in order to re-configure the Firewall in the new RAN (i.e., ‘pinholing’ the Firewall, assuming that the MN has ‘on-going’ active multimedia sessions, so that multimedia traffic is passed through the middlebox) adds significantly delay to the handoff latency and consequently may deteriorate the performance of the multimedia sessions.

Here we evaluate further what impact this may have on the multimedia sessions of a MN. Several multimedia protocols (e.g., H.323, SIP, RTSP etc.) and mechanisms have been developed to support multimedia mobile applications in a future all-IP networking architecture, meeting the demands of mobile end users (Tafazolli, 2005; Politis et al., 2007; Salsano et al., 2007). However, there are certain issues associated with the handling of multimedia sessions in such a mobile environment:

• Dynamic IP address and port. While the user hands off in a new RAN, he obtains a new IP address from entities such as FA (Mobile IP entity) or DHCP (Politis et al., 2007; Salsano et al., 2007). This means that a new association must be established at the middlebox for the new obtainable IP address. Furthermore multimedia signaling protocols like H.323, SIP, RTSP etc., use dynamic port to establish communication between the involved entities. These two restrictions prevent the use of static rulesfor middlebox devices such as Firewalls and NATs. As an example, in SIP protocol the pinholes are created according to the SDP information that is conveyed at SIP messages.

• IP address fields. Headers in the multimedia signaling protocols (for example in SIP protocol the headers- contact, record-route, via, from, to) contain fields that use IP addresses instead of domain names. As an effect, these addresses are private IP addresses and need to be translated to public routable IP addresses.

• Media transport. Multimedia payload is usually conveyed from protocols such as RTP that are blocked by middlebox devices such as Firewalls/NATs. Each application uses specific RTP ports to convey the media information.

• Lifetime issues. The binding between public and private IP addresses (NAT) and pinholing from incoming and outgoing traffic (Firewall) must be associated to the lifetime of each connection. These bindings will timeout on inactivity. Typical value of this inactivity is in the range of 60 s (Schultz, 2007). In case that this occurs, the end-user does not receive any incoming traffic. As the number of MNs within a RAN increases, the number of pinholes in the middlebox (Firewall/NAT) is increased and as an effect thereis an increase for possible security compromise of the middlebox.

• Session re-establishment. Suppose that a MN is establishing a multimedia session (e.g., SIP session, RTSP session) in a RAN and in the same time he or she is experiencing a handoff towards a new RAN while the session is still active. It is important to maintain the multimedia communications/session in the new RAN. This means that the session state characteristics(e.g., session id, RTP incoming/outgoing ports) must be transferred in the new RAN. The method of accomplishing session transfer depends on the media signaling protocol. For example, in SIP MNs send a ‘Re-Invite’ message towards the CN. This also necessitates SIP signaling traversal from the new RAN. After the new session is re-established in the new RAN, the real-traffic communication (i.e., RTP traffic) of the media path is established. This also necessitates the dynamic potholing of the appropriate RTP ports in the NAT/Firewall at the new RAN. The above procedure can be repeated for each active multimedia session that the MN has established with the corresponding CNs. While the MN moves to a new RAN, the bindings in the old RAN remain open until there is a timeout (typically 60 s). This is a security vulnerability that can be spoofed by a legitimate user and as an effect the NAT/Firewall may be compromised.

• Latency and jitter. Middleboxes can degrade QoS by introducing latency and jitter. An issue is not only how fast the firewall can interact with the network traffic, but how fast can process multimedia packets. First, the call setup process has to be done using H.323 or SIP. The presence of a NAT necessitates extra processing of each packet associated with port number.

4.1 Solution description

During the handoff, the interactions between MN, the multimedia servers and the middleboxes must be minimised. STM could facilitate the above procedure by forwarding the pre-established bindings of active sessions from the


middlebox (Firewall/NAT) of the old RAN to that in the new RAN. STM can be used to forward middlebox associated bindings of the MN’s active multimedia sessions from the old RAN to new RAN. Figure 10 shows a MN in RAN1 communicating with a CN and then handing off to RAN2. What is proposed in this paper is that upon handoff, context transfer exchange can be used between the involved middleboxes to update each other’s traffic control status dynamically. This involves a mutual communication between the middleboxes of the involved RANs. State

transfer signaling is used for the handshaking of this communication as shown in Figure 10. When the MN hands off in the new RAN2, it communicates with the middlebox by initiating a CU-Trig message. This message is sent from the MN to FW2. FW2 then requests from FW1 any bindings associated to the MN using a CU-Req message (see Figure 10). FW1 in turn replies with a CU-Rep message containing associated bindings which can then be used by FW2 to update its session or traffic control configuration.

Figure 10 Session re-establishment using State Transfer Module (see online version for colours)

The middleboxes in the old and new RAN may should exchange the following information for the active sessions of each MN:

• Media Signaling Protocol Type (e.g., SIP, MGCP, RTSP) for which the relevant middlebox states must be transferred from the old RAN in the new RAN.

• For each active multimedia session, the information regarding the relevant open RTP ports is transferred within the context transfer protocol, so that a fast establishment ‘pinholing’ procedure is accomplished in the Firewall at the new RAN.

• Information associated with the session ID, traffic type, port numbers, whether should be enabled, blocked or treated according to the local policies.

• MN’s new and previous IP addresses (Upon handoff the MN may move to a new RAN belonging to a different administration domain and thus a new IP address is assigned).

Furthermore the handoff of the MN in the new RAN can leave active firewall pinholes in the middlebox for some time in the old RAN. Such open holes may be subject to security vulnerabilities leading to middlebox compromise and DoS attacks. State transfer can alleviate these drawbacks by deleting states along the old path and help limit any security vulnerabilities that middleboxes may face.

This can be achieved using the CU-Req message which can inform FW1 to update its traffic control table.

A number of security threats are possible especially from a malicious MN. A MN which has not been authenticated and authorised before moving on the network can potentially request for context to be transferred to specific firewalls causing network disruptions. Multiple state transfer requests can also cause DoS attacks (Schultz, 1997). Also a rogue firewall may transfer undesired context to neighbour-firewalls causing again network/service disruptions as well as possible DoS attacks. To avoid such attacks it is assumed that there is some kind of security (trust) relationship between the Firewall in the initial RAN and the MN which initiates the context transfer. A security association is also assumed between the involved firewalls. As proposed in Loughney et al. (2005), IPsec should be supported between the involved Firewalls. It is preferable that such a secure channel should be set up prior to context transfer to avoid additional latency and any impact on the handoff performance of the MN.

4.2 Performance evaluation

4.2.1 Analytical modelling

Figure 11 illustrates the model used for quantitative analysis. In this scenario, the MN moves from one domain to another which is protected by a separate FW.


Figure 11 Middlebox state transfer for multimedia analysis (see online version for colours)

For our analysis we define a number of delay components among the involved entities. The values used in Table 3 are mainly based on Kong et al. (2006), Lai and Chiu (2005) and Lo et al. (2004).

Table 3 Typical values for multimedia context transfer modelling evaluation

Parameter Meaning Valuerange Experimental value

w One way delay across wireless link

10–50ms 20 ms

int One way delay between old (FW1) and new firewall (FW2)

30–100 ms 30 ms

fw–ap One way delay between firewall and Access Point (ap)

10–20 ms 10 ms

fw Time it takes for a Firewall to close an used open port

30–60 s 50 s

CN–MN Transmission Rate from CN–MN


100–1000 packets per second

Processingdelay + Routing table lookup at

0.001 ms Ignore

CN–MN Transmission rate from CN to MN


Variable

Based on Figure 11, the time required for the STM signalling procedure to be carried out can be regarded as the time from when the MN sends the CU Trig message until the time MID2 opens the necessary RTP ports. From the model on Figure 11, the total delay for the STM, STM can be determined as follows:

STM int2 3 .mn w fw ap fw

Similarly, we are interested in the time it takes for STM to close any ports left open at the old FW. This can be regarded as the time from when the MN sends the CU Trig to the time FW1 receives the CU-Req packet. Using Figure 11, this can be determined as follows:

STM int 2 .mn w fw ap fw

By using now the time required by STM, STM and the rate of which MN is receiving packets from CN ( CN–MN) we can determine the number of packets lost during this time.

The total handoff delay for each of these schemes is shown in Figure 12 against different values of wireless link delay. It is clear that the time required for the reactive scheme to complete is more than the predictive scheme as the signalling has to travel across a longer path to complete operation. By using now the time required by STM, STMand the rate of which MN is receiving packets from CN ( CN–MN) we can determine the number of packets lost during this time. This is shown in Figure 13 for different values of wireless link delay.

Figure 12 Additional handoff delay experienced at MN due to STM procedure at FW2 and time to close ports at FW1 (see online version for colours)

Figure 13 Packet loss experienced at MN during the STM procedure (see online version for colours)

4.2.2 Testbed evaluation

The proposed solution was also evaluated using a testbed implementation. Figure 14 shows the setup configuration. In this scenario the MN has an ongoing SIP session which he or she would like to maintain upon handoff. We assume that FW1 has been pre-configured to permit SIP calls (destination TCP or UDP port number set to 5060) whereas FW2 was not. After the handoff the MN sends a CU-Trig message to FW2. Upon reception of the CU-Trig, FW2 sends a CU-Req message to FW1, which in turn triggers a CU-Rep packet back to FW2. The CU-Req message is used both as a trigger for the CU-Rep message requesting firewall port status regarding the sessions of the specific mobile client but also informs FW1 about the sessions that the mobile client was using in order to close any unused open ports dynamically without depending on the timeouts.


Figure 14 Context transfer in both directions (see online version for colours)

The CU-Rep message also contains port and protocol information associated with the mobile client’s sessions. When FW2 receives this packet it has sufficient information to either enable or block any specific port, session number, traffic type etc. related to the mobile clients communication sessions and thus update its settings dynamically.

The performance of STM support for Firewalls was evaluated in the WNT for:

• informing the Firewall in the new RAN to make certain ports available (pinholing the Firewall)

• informing the Firewall in the previous RANs to close certain unused ports.

Figure 15 shows the streaming packets’ sequence received by the Mobile Client for a single handoff attempt.

Figure 15 The impact of handoff delay on a single communication stream

The handoff delay was measured from the time the last packet of the first part of the stream was received to the first packet of the second part of the stream and in this case it was approximately 1.25 s. This delay was caused by the combination of Mobile IP, Cellular IP and processing time at the client. The same procedure was repeated 10 times and the handoff delay was ranging between 0.9–1.38 s with average of about 1.2 s. Figure 16 shows the case when Middleboxes are set in the two domains configured with different policies: the first is set to allow UDP traffic through port 6970 whereas the second does not.

Figure 16 Middlebox blocks communication stream after handoff

Therefore once the mobile client handoffs to the new domain the stream he expects to receive is blocked by the new Middlebox and the traffic is lost. Figure 17 shows the case where Middlebox State Transfer is enabled between the two GWs. Figure 18 illustrates measurements associated with session re-establishment upon handoff takes place.

Figure 17 STM allows communication stream at FW to continue

Figure 18 The impact of handoff on the session re-establishment

State transfer is used to forward information associated to the mobile client’s streams e.g. protocol type, port numbers, so that the new FW can update its policies allowing the required streams to pass through. The handoff delay was again measured from the time the last packet of the first


part of the stream was received until the time of the first packet of the second part of the stream was received. In this case the delay was approximately 1.7 s. For establishing confidence in the results the same procedure where repeated ten times and in all cases the handoff delay was ranging from 1.39 s to 1.82 s, with average of 1.61 s.

Another set of measurements has been established. The aim of this setup was to measure the time required from the trigger sent by the MN to FW2, to the time it took for FW1 to close the specific ports associated with the MN’s sessions. Handoff was repeated ten times and the results are shown in Figure 19. It has been observed that using context transfer to inform FW1 it took on average approximately 1.35 s. It has to be noted that 30 s and 60 s are common timeout times configured at the Firewalls to close an unused port (Carpenter, 2002).

Figure 19 The impact of handoff to close unused port at the FWs

The above graphs illustrate the fact that knowledge of the mobility of a user can allow the Middlebox in the old RAN to dynamically close any open ports which are related to the active sessions of the mobile user. The time of 1.3 s is significantly smaller to the static timeouts of e.g., 60 s which the firewalls are commonly configured to do. This time difference can give a much smaller opportunity for attacks such as port scanning. Therefore the proposed solution not only maintains session re-establishment in the new RAN, but minimises any middlebox compromise in the old RAN due to user’s mobility.

5 Conclusion

In this paper we have described and evaluated a mechanism to enhance mobility management and maintain multimedia session continuity upon handoff. We have demonstrated how a STM could be employed for the purpose of forwarding state (AAA, and multimedia session) information among heterogeneous access networks. Two cases have been examined:

• How the STM could support middleboxes to provide multimedia sessions continuation during handoffs and at the same time minimise the risk for network attacks.

• How the STM could support the AAA procedure during mobility thus minimising their impact on the handoff performance and ongoing communication sessions.

The performance of the proposed solutions was evaluated analytically as well as in a WNT using various types of traffic and scenarios. The results demonstrated that the STM can effectively complement mobility management by minimising the impact of AAA and Middleboxes on the handoff performance and multimedia communication sessions as well as update middleboxes dynamically to minimise susceptibility for network attacks.

Seamless mobility across heterogeneous radio networks is a challenging research issue. Handover mechanisms that are able to provide seamless mobility are quite complicated and depend on functionality that spans across several layers in the networking protocol stack (from physical to network and application). The capability to provide context state transfer is essential in achieving fast performance in a heterogeneous wireless environment. Future research work will be towards the following directions

• Secure context state transfer in handovers between heterogeneous access technologies or network types. When a handover occurs timing constraints may forbid to perform a full new access procedure, including authentication and key agreement. Instead, the security context may have to be transferred between points of attachment in the network, which trust each other. The precise nature of the transferred security context needs to be specified, and the security for the discovery of points of attachment and of the transferred context need to be studied. While security context state transfer in horizontal handovers (access technology remains the same) has been solved in certain cases, security context transfer in vertical handovers (access technology changes) is largely unsolved.

• Secure security context adaptation in handovers between heterogeneous access networks. It may not be sufficient to merely transfer the security context in a handover, but the security context may need to be adapted according to the new environment. For instance, the IP address in an IPsec Security Association may change, or different cryptographic mechanisms or schemes to protect communication traffic are used.

Acknowledgement

This document has been produced in the context of the AN Project. The AN Project is part of the European Community’s Sixth Framework Program for research and is as such funded by the European Commission. All information in this document is provided ‘as is’ and no guarantee or warranty is given that the information is fit for any particular purpose. The views and conclusions contained herein are those of the authors and should not be


interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of the AN Project or the European Commission.

ReferencesSimon, D., Aboba, B. and Hurst, R. (2008) The EAP-TLS

Authentication Protocol, RFC 5216, Internet Engineering Task Force.

Berezdivin, R., Breining, R. and Topp, R. (2002) ‘Next-generation wireless communications concepts and technologies’, IEEECommunications Magazine, Vol. 40, pp.108–116.

Blunk, L. and Vollbrecht, J. (1998) The Extended Authentication Protocol (EAP), IETF RFC 2284.

Carpenter, B. (2002) Middleboxes: Taxonomy and Issues,RFC 3234 Internet Engineering Task Force.

Frantzen, M., Kerschbaum, F., Schultz, F. and Fahmy, S. (2001) ‘A framework for understanding vulnerabilities in firewalls using a dataflow model of firewall internals’, Computers and Security, Vol. 20, No. 3, pp.263–270.

Georgiades, M., Akhtar, N., Politis, C. and Tafazolli, R. (2004) ‘AAA Context transfer for seamless and secure multimedia services over all-IP infrastructures’, European Wireless Conference, February 24–27, Barcelona, Spain.

Kempf, J. (2002) Problem Description: Reasons for Performing Context Transfers Between Nodes in an IP Access Network,RFC 3374 Internet Engineering Task Force.

Kong, K., Song, M., Park, K. and Hwang, C. (2006) ‘A comparative analysis on the signalling load of mobile IPv6 and hierarchical mobile IPv6: analytical approach’, IEICE TRANS. INF. and SYST., Vol. E89-D, No. 1, pp.45–54.

Lai, W. and Chiu, J. (2005) ‘Improving handoff performance in wireless overlay networks by switching between two-layer IPv6 and one-layer IPv6 addressing’, IEEE Journal on Selected Areas in Communications, Vol. 23, No. 11, pp.65–77.

Leggio, S., Manner, J. and Raatikainen, K. (2005) ‘Achieving seamless mobility in IP-based radio access networks’, IEEEWireless Communications, Vol. 12, No. 1, pp.54–59.

Lo, S., Lee, G., Chen, W. and Liu, J. (2004) ‘Architecture for mobility and QoS support in all-IP wireless networks’, IEEE Journal on Selected Areas in Communications, Vol. 22, No. 4, pp.22–33.

Loughney, J., Nakhjiri, M., Perkins, C. and Koodli, R. (2005) Context Transfer Protocol (CXTP), RFC 4067 Internet Engineering Task Force.

Niebert, N., Schieder, A., Abramowicz, H., Malmgren, G., Sachs, J., Horn, U., Prehofer, C. and Karl, H. (2004) ‘Ambient networks: an architecture for communication networks beyond 3G’, IEEE Wireless Communication Magazine,Vol. 11, No. 2, pp.14–22.

Niebert, N., Schieder, A., Zander. J. and Hancock, R. (2007) Ambient Networks: Co-operative Mobile Networking for the Wireless World, ISBN: 0470510927, John Wiley & Sons.

Politis, I., Tsagkaropoulos, M., Dagiuklas, T., Kotsopoulos, S. and Stavroulakis, P. (2007) ‘On the QoS assessment of video sessions in heterogeneous 3G-WLAN networks with seamless and secure mobility support’, China Communications Magazine, Vol. 4, No.1, pp.105–119.

Rigney, C., Rubens, A., Simpson, W. and Willens, S. (1997) Remote Authentication Dial In User Service (RADIUS),RFC 2058 Internet Engineering Task Force.

Salsano, S. et al. (2007) ‘Architecture and testbed implementation of vertical handovers based on SIP session border controllers’, Wireless Personal Communications, Springer, Vol. 43, No. 3, pp.1019–1034.

Schultz, E. (1997) ‘When firewalls fail: lessons learned from firewall testing’, Network Security, Vol. 2, No.1, pp.8–11.

Sestini, F., da Silva, J. and Fernandez, F. (2003) ‘Expanding the wireless universe: EU research on the move’, IEEECommunications Magazine, Vol. 40, pp.132–140.

Surtees, A., Aguero, R., Eisl, J. and Georgiades, M. (2007) Mobility Management in Ambient Networks, VTC Spring, Dublin.

Tafazolli, R. (2005) Technologies for the Wireless Future,John Wiley & Sons, ISBN: 978-0-470-01235-2.

WebsitesSurrey Wireless Test Bed, http://www.ee.surrey.ac.uk/CCSR/

Mobile/Projects/Testbed/Host AP Emulator, http://hostap.epitest.fi/ Mobile IP Implementation, http://www.cs.hut.fi/Research/

Dynamics/

BibliographyAboba, B., Blunk, L., Vollbrecht, J., Carlson, J. and

Levkowetz, H. (Ed.) (2004) Extensible Authentication Protocol (EAP), RFC 3748, Internet Engineering Task Force.

Dagiuklas, T., Politis, C., Grilli, S., Bigini, G., Rebahi, Y., Sisalem, D. and Tafazolli, R. (2007) ‘Seamless multimedia sessions and real-time measurements across hybrid 3G and WLAN networks’, International Journal of Wireless and Mobile Computing, Vol. 4, No. 1, pp.1–14.

Gaylani, N. and Erten, Y. (2006) ‘Handling NAT traversal and mobility for multimedia traffic’, CCNC Conference, Vol. 1, Las Vegas, Nevada, USA, pp.112–116.

IEEE Standards for Local and Metropolitan Area Networks (2001) Port based Network Access Control, IEEE Standard 802.1X, ISBN: 0-7381-4856-3.

Nicolini, S., Salsano, S. and Veltri, L. (2007) Requirements for Vertical Handover of Multimedia Sessions Using SIP,Internet.

Toniatti, T., Meago, F., Periccioli, A., Uno, S., Perera, E. and Boreli, R. (2005) ‘Advanced network handover mechanism in ambient networks’, Proceedings of WPMC 2005, International Symposium on Wireless Personal Multimedia Communications, Aalborg, Denmark.

On the enhancement of mobility and multimedia communications in heterogeneous RANs

Documents

Transcript of On the enhancement of mobility and multimedia communications in heterogeneous RANs