
\section{Introduction}

%\cite{Perkins} 
%{\it mobile node}
% \footnote{ This work was supported by the U.S. Department of Defense }

Recently wireless security \cite{itcp} as found in the popular 802.11 [cite]
wireless protocol has suffered a series of failures due to the
apparently collapse of part of the 802.11 [cite] specification
called WEP, for  "Wired Equivalent Privacy".  WEP was intended to
offer security services including encryption and authentication.
Security experts have recently demonstrated substantial security
problems with WEP.  Borisov, et. al [cite], described security and
network architectural flaws in WEP's architecture.  Fluhrer, Mantin,
and Shamir described a theoretical attack against the RC4 stream
cipher used in WEP.  Worse, in a recent ATT technical report [cite],
Stubblefield, Ioannidis, and Rubin implemented the attack [cite].

The ATT paper in its conclusions suggests that the 802.11 link layer
be viewed as insecure.  To be fair, the IEEE 802.11 specification stated
that WEP was not only optional, but was intended to make wireless
"at least as secure (sic) as a wire".  Unfortunately, this may be misleading
to naive users who assume that WEP would offer serious confidentiality
services.

The Borisov paper, and the ATT technical report 
both suggest that users should consider using higher-level protocols; e.g.,
IPSEC [cite] and Secure Shell.  We concur and further suggest that
IPSEC could be directly combined with Mobile-IP in order to make
a Virtual Private Network mechanism that is completely based on
the layer 3 network layer.  DARPA funded research along those lines
at Portland State, between 1995-1999 [cite].  In this paper, we intend to 
explore two different experimental system architectures for a combined
Mobile-IP/IPSEC implementation.  The earliest architecture was crewated
on the FreeBSD 2.2.8 platform using an IPSEC supplied for NetBSD originally
by the Naval Research Labs and the PSU Mobile-IP implementation.  Our
most recent architecture is based on the second generation IPSEC in
the more recent 4.3 FreeBSD called KAME, which has been combined again 
with PSU's Mobile-IP.

In section 2, we introduce the PSU mobile-ip routing architecture,
and explain how the routing daemons function vis-a-vis the BSD
routing table.  In section 3, we present our older closely-coupled
IPSEC/Mobile-IP architecture, and we also briefly present a set of
mobile routing policies, that we have developed as architectural
paradigms.  In section 4, we present our newer loosely-coupled
architecture in which we have combined our Mobile-IP with the current
BSD KAME/IPSEC system.  In section 5, we present some architectural
analysis in terms of system organization, and finally in section 6,
we present our conclusions.


