Subject: Re: [MOBILE-IP] AAA functionality

From: Patrice Calhoun <[email-masked]>
Date: Tue, 4 Jan 2000 09:20:11 -0800

Perhaps I am missing something, but I *really* don't see how the AAA
and Mobile-IP requests can be done in parallel. If a requirement is
that it must be possible to separate the two, then I would prefer to
see that both requests are done sequentially, first AAA then Mobile-IP.
This would remove many strange interactions, and would be a much cleaner
approach.

PatC
>Hello,
>
>There has been some discussion about how to let AAA authorize
>a mobile node's connectivity separately from the process of
>Mobile IP registration.  The idea would be to give a mobile
>node a little unauthorized time while the AAA process
>goes to completion.  It is expected that a Mobile IP registration
>will be faster than authentication/authorization by AAA.
>
>Suppose that the Mobile IP registration succeeds, and the AAA
>authentication fails.  Then, one might expect that the Mobile IP
>registration should be terminated immediately without waiting for
>the registration lifetime to expire.  Mobile IP does not currently
>have any mechanism to do this.  I think the mobile node has to
>be notified that something went wrong.  Thus, we need a way to
>send the notification to the mobile node.
>
>This could be a new Mobile IP message, or ICMP, or ... ?
>Any such message would have to be authenticated in some
>way that is credible to the mobile node.
>
>The alternative would be just to cut off service to the mobile
>node without notification, which seems rather draconian.
>
>Can anyone offer a good solution to enable this sort of
>parallel processing for mobile node registrations?
>
>Regards,
>Charlie P.

---

From: Xinhua Zhao <[email-masked]>
Date: Tue, 4 Jan 2000 12:19:13 -0800

> This would remove many strange interactions, and would be a much cleaner

I agree that it would be a cleaner approach to do them sequentially.
Although doing them in parallel won't work without devising some new
mechanism, the idea of letting a mobile host to obtain connectivity
as soon as possible (potentially translating into faster handoff)
without having to wait for AAA (presumably takes longer) to complete
is worth some consideration.

So, in case we want to do them in parallel, there is another
possibility in addition to the two mentioned by Charlie. See below.

> >parallel processing for mobile node registrations?

Another possibility would be for the mobile host to treat the
registration reply as temporary (with a certain timeout value),
indicated through an extension. Short of subsequent AAA
authorization messages, the mobile host must terminate the
registration at the end of the temporary usage period. The
advantage of this approach is that it does not introduce any
new messages.

Regards,

Xinhua

MosquitoNet Project on Mobile and Wireless Computing
Stanford University
http://MosquitoNet.Stanford.EDU