Subject: Re: [MSEC] Re: I-D ACTION : Simple Multicast Receiver Access Control

From: [email-masked]
Date: Wed, 28 Nov 2001 14:30:09 -0500

Hi,

The token should definitely be released if:
     - the ip address changes;
     - a reboot happens;
     - the token expires.

Any relationship between the token and the ip address ?

Regards,

                    "Michael Germony"                                                                                    
                    <mgermony@mandtbank.       To:     <[email-masked]>                                       
                    com>                       cc:     <[email-masked]>, <[email-masked]>         
                    Sent by:                   Subject:     Re: [MSEC] Re: I-D ACTION : Simple Multicast Receiver Access 
                    msec-admin@securemul        Control                                                                  
                    ticast.org                                                                                           

                    11/28/2001 01:46 PM                                                                                  

Ghassan and Haixiang,

According to my understanding of the DHCP RFC, the only way that a client
would loose its IP address after it reboots is if during the time it
rebooted the DHCP server issued the same IP address to another client
(likely only in extremely small or busy scopes) OR if the duration of the
reboot exceeded 50% of the lease time defined in the scope. Otherwise it
will get the same address issued. The only other possible way that it would
get a different DHCP address is if the DHCP server's scope cache was
flushed.

Either way, wouldn't the reboot presumably cause the token to be released?

Regards,
Michael Germony
Web Architecture Services
[email-masked]

>>> "Haixiang He" <[email-masked]> 11/28/01 10:37AM >>>

>
>
> I mean if the host obtains an access token for an IP address A1, then if
> this host reboots and uses DHCP,  its new address, A2, would be
> different from A1. Consequently it will not be capable to join another
> groups. And, since the access token, is used to prevent another host
> *outside* the same network to use the same access token. You do't care
> about hosts *inside* the network. For this reason, the use of prefix ( a
> prefix could represent the set of addresses used by DHCP, if it is used)
> can resolve the problem of dynamic configuration of hosts.

I did not think about this scenario in greater details. The problem with
using
prefix is that it does not work well with switch network such as switch
ethernet.
In switch network, two hosts connecting two different ports may have the
same
prefix.

And also we did not try to apply this solution for mobile node at this
time.

Haixiang

> Ghassan

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec

---

From: "Haixiang He" <[email-masked]>
Date: Wed, 28 Nov 2001 14:35:24 -0500

> Any relationship between the token and the ip address ?

I was trying to make sure that other illegal hosts cannot reuse the same token. One way to achieve this goal is to put the
host IP address in the Access Token. This solution is simple in my view and also does not require router to maintain other
information.

Haixiang