Subject: Re: [MOBILE-IP] AAA functionality

From: Patrice Calhoun <[email-masked]>
Date: Tue, 4 Jan 2000 16:26:46 -0800

I second this concern for security. Note that in the PPP world, which is
really not all that different from what we are talking about here, I have
I *never* heard of a PPP server granting temporary access while waiting for
the AAA server to respond.

If no authentication is required, then simply do not use AAA.

Again, sequential is the correct behavior.

PatC
>    I don't think I'd be in favor of parallel AAA and MIP authentications where
>the MN is allowed some short access time.  I am assuming you mean only the
>first
>registration with a FA would be allowed for a short time, otherwise the MN will
>simply 'renew' every second to stay within that window.  If a good parallel
>mechanism came forward I might be in favor of that, but not where the MN has
>some free time (figuratively, and literally).  I see this as allowing a short
>security violation on the grounds that it may not really be a security
>violation.
>
>    A mechanism to allow the registration reply to have a short timeout,
>requireing the MN to be 'honorable' and stop trying to use it's binding is
>silly, since the FA is the enforcement point.  I agree the FA killing the
>service without letting the MN node is draconian, so there needs to be a way
>for
>the MN to know its been cut off.  The FA could simply send a registration reply
>with a denial, though this breaks RFC2002[-bis] in that an FA isn't allowed to
>generate a registration reply that is not in response to a request (though I
>suppose you could argue it's simply the second response to a request).
>Personally, I've always thought there should be a way to terminate a binding in
>MIP, independant of what AAA may need it for.
>
>                              Cheers,
>                                  Steve
>
>
>>X-Virus-Scanned: Tue, 4 Jan 2000 09:10:55 -0800 Nokia Silicon Valley AntiVirus
>Appliance
>>X-Accept-Language: en
>>MIME-Version: 1.0
>>Content-Transfer-Encoding: 7bit
>>From: "Charles E. Perkins" <[email-masked]>
>>Subject: [MOBILE-IP] AAA functionality
>>To: [email-masked]
>>
>>Hello,
>>
>>There has been some discussion about how to let AAA authorize
>>a mobile node's connectivity separately from the process of
>>Mobile IP registration.  The idea would be to give a mobile
>>node a little unauthorized time while the AAA process
>>goes to completion.  It is expected that a Mobile IP registration
>>will be faster than authentication/authorization by AAA.
>>
>>Suppose that the Mobile IP registration succeeds, and the AAA
>>authentication fails.  Then, one might expect that the Mobile IP
>>registration should be terminated immediately without waiting for
>>the registration lifetime to expire.  Mobile IP does not currently
>>have any mechanism to do this.  I think the mobile node has to
>>be notified that something went wrong.  Thus, we need a way to
>>send the notification to the mobile node.
>>
>>This could be a new Mobile IP message, or ICMP, or ... ?
>>Any such message would have to be authenticated in some
>>way that is credible to the mobile node.
>>
>>The alternative would be just to cut off service to the mobile
>>node without notification, which seems rather draconian.
>>
>>Can anyone offer a good solution to enable this sort of
>>parallel processing for mobile node registrations?
>>
>>Regards,
>>Charlie P.

---

From: Luca Salgarelli <[email-masked]>
Date: Tue, 4 Jan 2000 21:20:16 -0500

Pat,

I don't agree with you here: with MIP there could be the need of a fast
hand-off to a new domain. That need is probably not (yet) so urgent in the
PPP world.

While I agree that there are some security concerns, I think there is the
need to design a AAA/MIP interaction scheme that guarantees fast hand-offs.

Luca