Subject: Re: [MOBILE-IP] AAA functionality

From: "Lipford, Mark" <[email-masked]>
Date: Wed, 5 Jan 2000 18:41:38 -0600

As a wireless carrier interested in deploying a MIP solution I don't feel
comfortable allowing a "grace" period.  We have received many request for
potential customers on how quickly they could send a "short burst" of data
through our network for particular applications (i.e. telemetry and
telematics are two big ones).  If we allow users a grace period they could
potentially run their business without getting properly authorized.  While
there are possibly other ways to block this usage AAA is the best solution.

                -----Original Message-----
                From:   Patrik Flykt [mailto:[email-masked]]
                Sent:   Wednesday, January 05, 2000 2:40 AM
                To:     [email-masked]
                Subject:        Re: [MOBILE-IP] AAA functionality

                        Hi,

                >Perhaps I am missing something, but I *really* don't see
how the AAA
                >and Mobile-IP requests can be done in parallel. If a
requirement is
                >that it must be possible to separate the two, then I would
prefer to
                >see that both requests are done sequentially, first AAA
then Mobile-IP.
                >This would remove many strange interactions, and would be a
much cleaner
                >approach.

                I suppose there is a requirement that AAA and MIP messages
can be separated
                (be it parallell or serial message sending). When you pay
for access with
                your credit card the authorization/accounting goes to the
credit card
                company's AAA server, while the Mobile IP messages go to
your home agent.

                The sequential approach is extremely useful if the only case
of using AAA
                with MIP is to ensure that the provider of the foreign agent
is able to
                account for every second of foreign agent usage. However,
the provider could
                also be interested in allowing a short grace period to
ensure that the
                real-time applications used in the mobile node would
experience the shortest
                possible service disruption. I suppose the AAA processing
will take at least
                a couple of seconds and even longer when there are several
brokers between
                the visited and home domains. The grace period enables of
course a
                possibility of fraud, which the provider has to take into
account.
                Minimizing fraud could be done for example by allowing the
grace period only
                to those who have visited the same provider's network
earlier and have been
                given a session key, as described in the "Minimal Latency
Secure Hand-off"
                draft. There is also a third possibility when the provider
is providing free
                access for everyone without any accounting but with
authorization. The
                provider wants to be sure that the home AAA domain
authorizes the mobile
                node, i.e. it is not stolen, in the (for some reason) wrong
domain, etc.

                Regards,

                        Patrik

---

From: Phil Karn <[email-masked]>
Date: Wed, 5 Jan 2000 17:28:23 -0800

>there are possibly other ways to block this usage AAA is the best solution.

Why is this an issue for you? In a properly layered network, Mobile IP
would be outside the scope of the wireless carrier. It would exist as
a co-located FA on the mobile user's computer and as a HA on the
user's home network, e.g., at his residence or business. That's if it
even existed at all, since MIP would be a user choice, and most mobile
users given the choice wouldn't need it in the first place.

You would just charge for the user's generic internet access service,
and the behavior of MIP (or even its existence) wouldn't matter to
you.  It would all just be billable user data to you.

Phil