Mobile IPv6 security while traversing a NAT

Abstract

The mobile IPv6 protocol allows a mobile node to move from one link to another without changing the mobile node's home address by using a care-of address. When a mobile node moves to a foreign link behind a NAT, it uses a local-scope care-of address, which has been allocated by a foreign router dominating the visited network, as identification of itself. On the other hand, other nodes outside the NAT are going to identify the mobile node by a public care-of address translated into from the local-scope care-of address by the NAT. As each security mechanism running over mobile IPv6 relies on the IP address information, it brings about many critical problems. Therefore, in this paper, we propose some modifications to the legacy mobility messages by just adding single flag to address incompatibilities caused by NAT-deployment. With the new proposed mechanism, we can provide secure and seamless IPv6 mobility services regardless of the mobile node's current point of attachment to the Internet, even though it is located behind a NAT.